Live data from Hacker News

Playing with ZFS encryption on Linux

rolando.cl

11–20 of 56 posts

Re: Playing with ZFS encryption on Linux

#11
post #3

I'm not really familiar with the development process between ZFS on Linux and ZFS on BSD, do these pull requests usually get merged upstream for use on BSD, Solaris, etc?

Solaris is completely separate, but I believe the encryption comes from Illumos just needs a ton of changing to work on Linux.

Just the crypto primitives are from Illinois iirc, the actual scheme is fairly new.

Re: Playing with ZFS encryption on Linux

#12
post #5

64 bytes seems like an arbitrarily short limit for passphrases; it's going to be hashed at some point anyway (preferably with a decent KDF designed for the purpose) and 64 bytes is nowhere near long enough for natural English language text to be used to derive 32 bytes of entropy (estimates of English language text are ~1.5bits of entropy per character).

At the risk of invoking Cunningham's Law, nobody uses passphrases anywhere near 64 bytes that he / she has to memorize. And if you're using a password manager, just use the raw or hex key option.

32 bytes => 64 hex digits, which is probably not a coincidence. :-)

Re: Playing with ZFS encryption on Linux

#13
Does anyone know a good guide for getting set up with ZFS (particularly on Linux/Ubuntu)? The Ubuntu wiki basically just say "apt install zfs" and then links to a page that appears to be a brain dump of all the possible commands. Something with more coherence explanation of the relevant concepts would be really helpful.

Re: Playing with ZFS encryption on Linux

#14

Does anyone know a good guide for getting set up with ZFS (particularly on Linux/Ubuntu)? The Ubuntu wiki basically just say "apt install zfs" and then links to a page that appears to be a brain dump of all the possible commands. Something with more coherence explanation of the relevant concepts would be really helpful.

[1] is a nice explanation of getting set up with ZFS root on Ubuntu 16.04 with explanations for what each of the commands are doing.

I'm not in a good position to judge whether this is the correct level of detail for someone new to ZFS; it seems slightly lighter on explanation of concepts than I'd prefer.

[2] seems reasonably nice at a quick look.

[1] - https://github.com/zfsonlinux/zfs/wiki/Ubuntu-16.04-Root-on-...

[2] - http://kbdone.com/zfs-basics/

Re: Playing with ZFS encryption on Linux

#15
post #5

64 bytes seems like an arbitrarily short limit for passphrases; it's going to be hashed at some point anyway (preferably with a decent KDF designed for the purpose) and 64 bytes is nowhere near long enough for natural English language text to be used to derive 32 bytes of entropy (estimates of English language text are ~1.5bits of entropy per character).

I suggest posting this feedback in the pull request.

https://github.com/zfsonlinux/zfs/pull/5769

Re: Playing with ZFS encryption on Linux

#16
post #3

I'm not really familiar with the development process between ZFS on Linux and ZFS on BSD, do these pull requests usually get merged upstream for use on BSD, Solaris, etc?

Together FreeBSD, ZoL and the Illumos groups work on OpenZFS. Oracle closed off Solaris. The decendent of Open Solaris is Illumos. Oracle ZFS and OpenZFS are not hte same thing. OpenZFS repo is the upstream, though it is closely tracks the Illumos version. From there the projects pull on OpenZFS to create their implementations. New features are developed independently by the projects with rules that a new feature mus…

Let's not forget Mac OS X and OSv, although the amount of work being done that and shared is not as large as it is with the other 3 platforms.

Re: Playing with ZFS encryption on Linux

#17
post #5

64 bytes seems like an arbitrarily short limit for passphrases; it's going to be hashed at some point anyway (preferably with a decent KDF designed for the purpose) and 64 bytes is nowhere near long enough for natural English language text to be used to derive 32 bytes of entropy (estimates of English language text are ~1.5bits of entropy per character).

It’s using PBKDF2 with a configurable amount of rounds. So yeah. Strange it limits the length

Re: Playing with ZFS encryption on Linux

#18
post #5

64 bytes seems like an arbitrarily short limit for passphrases; it's going to be hashed at some point anyway (preferably with a decent KDF designed for the purpose) and 64 bytes is nowhere near long enough for natural English language text to be used to derive 32 bytes of entropy (estimates of English language text are ~1.5bits of entropy per character).

At the risk of invoking Cunningham's Law, nobody uses passphrases anywhere near 64 bytes that he / she has to memorize. And if you're using a password manager, just use the raw or hex key option. 32 bytes => 64 hex digits, which is probably not a coincidence. :-)

Password yes, passphprase it's quite possible.

Re: Playing with ZFS encryption on Linux

#19
post #18

Earlier quoted context omitted.

At the risk of invoking Cunningham's Law, nobody uses passphrases anywhere near 64 bytes that he / she has to memorize. And if you're using a password manager, just use the raw or hex key option. 32 bytes => 64 hex digits, which is probably not a coincidence. :-)

Password yes, passphprase it's quite possible.

Eh, Materialistic doesn't allow me to edit my comment. I mean you're right about passwords, but a passphrases (e.g. a sentences) are easy to remember, more secure and can often be longer than 64 bytes.

Re: Playing with ZFS encryption on Linux

#20

Does anyone know a good guide for getting set up with ZFS (particularly on Linux/Ubuntu)? The Ubuntu wiki basically just say "apt install zfs" and then links to a page that appears to be a brain dump of all the possible commands. Something with more coherence explanation of the relevant concepts would be really helpful.

if it's about management, then you might want to look at the docs I recommend in the post: Oracle's docs are very detailed[1] and the freebsd handbook[2] is very useful as well.

[1]: http://docs.oracle.com/cd/E19253-01/819-5461/gamnq/index.htm...

[2]: https://www.freebsd.org/doc/handbook/zfs.html

Post reply on HN