OpenBSD disk encryption (2015)
xn--thibaud-dya.fr
OpenBSD disk encryption (2015)
1–10 of 13 posts
Re: OpenBSD disk encryption (2015)
#2Recently there are more and more BSD related news :)
Re: OpenBSD disk encryption (2015)
#3Recently there are more and more BSD related news :)
I think that's great. The BSD projects have been extremely undervalued. OpenBSD provides OpenSSH, LibreSSL, etc. FreeBSD provided a lot code to Mac OS X and used used in a some commercial products (Playstation's OS, Juniper routers, etc.).
The BSDs have worked on shoestring budgets. Let's hope this attention leads to more sponsorship!
Re: OpenBSD disk encryption (2015)
#4Recently there are more and more BSD related news :)
I think that's great. The BSD projects have been extremely undervalued. OpenBSD provides OpenSSH, LibreSSL, etc. FreeBSD provided a lot code to Mac OS X and used used in a some commercial products (Playstation's OS, Juniper routers, etc.). The BSDs have worked on shoestring budgets. Let's hope this attention leads to more sponsorship!
And DragonFlyBSD provides HAMMER https://www.dragonflybsd.org/hammer/
Worth mentioning, BSD were the only systems that disabled Intels RNG after leaks that it might be compromised and Intel cooperate with NSA.
https://www.freebsdfoundation.org/donate/
Re: OpenBSD disk encryption (2015)
#5I think that almost every experienced Linux user has some secret love for *BSD deep down, myself included. They just seem to get it right for the majority of times.
Re: OpenBSD disk encryption (2015)
#6What's with this highlighted comment? Are you guaranteed corruption on every half terabyte?
> "XXX - this does not handle the case where the read/write spans across a different key blocks (e.g. 0.5TB boundary). Currently this is already broken by the use of scr_key[0] below."
Re: OpenBSD disk encryption (2015)
#7What's with this highlighted comment? Are you guaranteed corruption on every half terabyte? > "XXX - this does not handle the case where the read/write spans across a different key blocks (e.g. 0.5TB boundary). Currently this is already broken by the use of scr_key[0] below."
Based on my reading of the article, it says that OpenBSD always uses the same key, scr_key[0], and does not implement the use of different keys for different parts of the disk. I haven't looked at the OpenBSD source code to confirm this, though.
Re: OpenBSD disk encryption (2015)
#8Earlier quoted context omitted.
I think that's great. The BSD projects have been extremely undervalued. OpenBSD provides OpenSSH, LibreSSL, etc. FreeBSD provided a lot code to Mac OS X and used used in a some commercial products (Playstation's OS, Juniper routers, etc.). The BSDs have worked on shoestring budgets. Let's hope this attention leads to more sponsorship!
And DragonFlyBSD provides HAMMER https://www.dragonflybsd.org/hammer/ Worth mentioning, BSD were the only systems that disabled Intels RNG after leaks that it might be compromised and Intel cooperate with NSA. https://www.freebsdfoundation.org/donate/ https://www.openbsd.org/donations.html https://www.dragonflybsd.org/donations/
With regards the RNG, to be it showed a lack of understanding of how seeding RNG generators work.
Perhaps Intel's RNG can, in some cases, be persuaded to produce a low-quality, or otherwise broken stream. This seems plausable (there could be a deniable 'bug' which causes this to happen), but there are many low quality data streams fed into the random number generator, it never hurts to add another.
However, for things like VMs, soon after startup the CPU RNG is about the only possible source of random data, so I suspect there are more users who are being hurt by not having a well enough seeded RNG than those being helped by it being disabled (which is none).
If these two points seem contradictory, they are not. It would always be better to have multiple sources of quality input to the RNG, because as long as one of them isn't corrupted / low quality, you will get decent quality random numbers out. Safety in numbers!
Re: OpenBSD disk encryption (2015)
#9Recently there are more and more BSD related news :)
Re: OpenBSD disk encryption (2015)
#10interesting domain name. HN shows it as xn--thibaud-dya.fr but browers show it as thiebaud.fr (accented e) . Reminds me of something I read here on HN about a month ago about the history of web/URLs