[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] [PATCH v10 13/20] qcow2: add support for LUKS encryptio
From: |
Alberto Garcia |
Subject: |
Re: [Qemu-devel] [PATCH v10 13/20] qcow2: add support for LUKS encryption format |
Date: |
Mon, 26 Jun 2017 15:28:58 +0200 |
User-agent: |
Notmuch/0.18.2 (http://notmuchmail.org) Emacs/24.4.1 (i586-pc-linux-gnu) |
On Fri 23 Jun 2017 06:24:12 PM CEST, Daniel P. Berrange wrote:
> This adds support for using LUKS as an encryption format
> with the qcow2 file, using the new encrypt.format parameter
> to request "luks" format. e.g.
>
> # qemu-img create --object secret,data=123456,id=sec0 \
> -f qcow2 -o encrypt.format=luks,encrypt.key-secret=sec0 \
> test.qcow2 10G
>
> The legacy "encryption=on" parameter still results in
> creation of the old qcow2 AES format (and is equivalent
> to the new 'encryption-format=aes'). e.g. the following are
> equivalent:
>
> # qemu-img create --object secret,data=123456,id=sec0 \
> -f qcow2 -o encryption=on,encrypt.key-secret=sec0 \
> test.qcow2 10G
>
> # qemu-img create --object secret,data=123456,id=sec0 \
> -f qcow2 -o encryption-format=aes,encrypt.key-secret=sec0 \
> test.qcow2 10G
>
> With the LUKS format it is necessary to store the LUKS
> partition header and key material in the QCow2 file. This
> data can be many MB in size, so cannot go into the QCow2
> header region directly. Thus the spec defines a FDE
> (Full Disk Encryption) header extension that specifies
> the offset of a set of clusters to hold the FDE headers,
> as well as the length of that region. The LUKS header is
> thus stored in these extra allocated clusters before the
> main image payload.
>
> Aside from all the cryptographic differences implied by
> use of the LUKS format, there is one further key difference
> between the use of legacy AES and LUKS encryption in qcow2.
> For LUKS, the initialiazation vectors are generated using
> the host physical sector as the input, rather than the
> guest virtual sector. This guarantees unique initialization
> vectors for all sectors when qcow2 internal snapshots are
> used, thus giving stronger protection against watermarking
> attacks.
>
> Signed-off-by: Daniel P. Berrange <address@hidden>
Reviewed-by: Alberto Garcia <address@hidden>
Berto
- [Qemu-devel] [PATCH v10 10/20] qcow2: make qcow2_encrypt_sectors encrypt in place, (continued)
- [Qemu-devel] [PATCH v10 10/20] qcow2: make qcow2_encrypt_sectors encrypt in place, Daniel P. Berrange, 2017/06/23
- [Qemu-devel] [PATCH v10 12/20] qcow2: extend specification to cover LUKS encryption, Daniel P. Berrange, 2017/06/23
- [Qemu-devel] [PATCH v10 07/20] block: deprecate "encryption=on" in favor of "encrypt.format=aes", Daniel P. Berrange, 2017/06/23
- [Qemu-devel] [PATCH v10 11/20] qcow2: convert QCow2 to use QCryptoBlock for encryption, Daniel P. Berrange, 2017/06/23
- [Qemu-devel] [PATCH v10 15/20] iotests: enable tests 134 and 158 to work with qcow (v1), Daniel P. Berrange, 2017/06/23
- [Qemu-devel] [PATCH v10 14/20] qcow2: add iotests to cover LUKS encryption support, Daniel P. Berrange, 2017/06/23
- [Qemu-devel] [PATCH v10 13/20] qcow2: add support for LUKS encryption format, Daniel P. Berrange, 2017/06/23
- Re: [Qemu-devel] [PATCH v10 13/20] qcow2: add support for LUKS encryption format,
Alberto Garcia <=
- [Qemu-devel] [PATCH v10 16/20] block: rip out all traces of password prompting, Daniel P. Berrange, 2017/06/23
- [Qemu-devel] [PATCH v10 18/20] block: pass option prefix down to crypto layer, Daniel P. Berrange, 2017/06/23
- [Qemu-devel] [PATCH v10 17/20] block: remove all encryption handling APIs, Daniel P. Berrange, 2017/06/23
- [Qemu-devel] [PATCH v10 19/20] qcow2: report encryption specific image information, Daniel P. Berrange, 2017/06/23
- [Qemu-devel] [PATCH v10 20/20] docs: document encryption options for qcow, qcow2 and luks, Daniel P. Berrange, 2017/06/23
- Re: [Qemu-devel] [PATCH v10 00/20] Convert QCow[2] to QCryptoBlock & add LUKS support, Max Reitz, 2017/06/26