Playing with ZFS encryption on Linux

#1

Post by funkaster » Tue, Jun 20, 2017, 12:40 AM UTC

Playing with ZFS encryption on Linux
rolando.cl

Re: Playing with ZFS encryption on Linux

#2

Post by symlinkk » Tue, Jun 20, 2017, 2:20 AM UTC

nice post, I think you forgot to fill in the Introduction though

Re: Playing with ZFS encryption on Linux

#3

Post by ubercow » Tue, Jun 20, 2017, 2:39 AM UTC

I'm not really familiar with the development process between ZFS on Linux and ZFS on BSD, do these pull requests usually get merged upstream for use on BSD, Solaris, etc?

Re: Playing with ZFS encryption on Linux

#4

Post by aidenn0 » Tue, Jun 20, 2017, 2:44 AM UTC

ubercow wrote: post #3

I'm not really familiar with the development process between ZFS on Linux and ZFS on BSD, do these pull requests usually get merged upstream for use on BSD, Solaris, etc?

OpenZFS[1] is upstream for all of the currently maintained open-source ZFS implementations, including ZoL and FreeBSD.

1: http://open-zfs.org/wiki/Main_Page

Re: Playing with ZFS encryption on Linux

#5

Post by aidenn0 » Tue, Jun 20, 2017, 2:48 AM UTC

64 bytes seems like an arbitrarily short limit for passphrases; it's going to be hashed at some point anyway (preferably with a decent KDF designed for the purpose) and 64 bytes is nowhere near long enough for natural English language text to be used to derive 32 bytes of entropy (estimates of English language text are ~1.5bits of entropy per character).

Re: Playing with ZFS encryption on Linux

#6

Post by funkaster » Tue, Jun 20, 2017, 2:51 AM UTC

symlinkk wrote: post #2

nice post, I think you forgot to fill in the Introduction though

thanks! I think I stupidly lost that paragraph in a merge. I'll remove it for now and add it later. Thanks again!

Re: Playing with ZFS encryption on Linux

#7

Post by binwiederhier » Tue, Jun 20, 2017, 3:02 AM UTC

A little more details on the crypto aspects: https://blog.heckel.xyz/2017/01/08/zfs-encryption-openzfs-zf... (This is my post. I hope it's okay to post this here.)

Re: Playing with ZFS encryption on Linux

#8

Post by funkaster » Tue, Jun 20, 2017, 3:17 AM UTC

binwiederhier wrote: post #7

A little more details on the crypto aspects: https://blog.heckel.xyz/2017/01/08/zfs-encryption-openzfs-zf... (This is my post. I hope it's okay to post this here.)

This is really good! I was trying to find some time to write about the crypto details of it, but your post is a great summary :) I'll add a reference to it in my post.

Re: Playing with ZFS encryption on Linux

#9

Post by boomboomsubban » Tue, Jun 20, 2017, 3:38 AM UTC

ubercow wrote: post #3

I'm not really familiar with the development process between ZFS on Linux and ZFS on BSD, do these pull requests usually get merged upstream for use on BSD, Solaris, etc?

Solaris is completely separate, but I believe the encryption comes from Illumos just needs a ton of changing to work on Linux.

Re: Playing with ZFS encryption on Linux

#10

Post by AndrewDavis » Tue, Jun 20, 2017, 3:50 AM UTC

ubercow wrote: post #3

I'm not really familiar with the development process between ZFS on Linux and ZFS on BSD, do these pull requests usually get merged upstream for use on BSD, Solaris, etc?

Together FreeBSD, ZoL and the Illumos groups work on OpenZFS.

Oracle closed off Solaris. The decendent of Open Solaris is Illumos. Oracle ZFS and OpenZFS are not hte same thing.

OpenZFS repo is the upstream, though it is closely tracks the Illumos version.

From there the projects pull on OpenZFS to create their implementations. New features are developed independently by the projects with rules that a new feature must be enabled in a downstream distro for X period of time before it can be upstreamed into OpenZFS.