Re: [Qemu-devel] Adding dmcrypt to QEMU block drivers

[Stefan Hajnoczi]

On Tue, Mar 18, 2014 at 01:30:44PM +0000, Daniel P. Berrange wrote:
> On Tue, Mar 18, 2014 at 02:08:19PM +0100, Stefan Hajnoczi wrote:
> > On Mon, Mar 17, 2014 at 08:48:08PM -0400, Hamilton, Peter A. wrote:
> > I guess the filter would be deployed below the image format:
> > qcow2 -> luks -> file
> 
> I could see it being either above or below the image format at
> mgmt app's choice. Having it above the image format means only
> the payload is encrypted, so you can still query the basic
> metadata (like logic disk size, backing files) without decrypting,
> which is a nice aspect of the way qcow2 encryption historically
> worked. I could see though that people might want even the header
> encrypted to prevent anyone seeing anything about the image format
> without keys.

The difference is that if you encrypt just the payload then dmcrypt
compatibility is much less useful since the data is now intermingled
with image format metadata.

But I agree in some cases it may be the right thing to do.