[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-block] [PATCH v7 12/20] qcow2: extend specification to cover L
From: |
Eric Blake |
Subject: |
Re: [Qemu-block] [PATCH v7 12/20] qcow2: extend specification to cover LUKS encryption |
Date: |
Thu, 25 May 2017 14:39:56 -0500 |
User-agent: |
Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.1.0 |
On 05/25/2017 11:38 AM, Daniel P. Berrange wrote:
> Update the qcow2 specification to describe how the LUKS header is
> placed inside a qcow2 file, when using LUKS encryption for the
> qcow2 payload instead of the legacy AES-CBC encryption
>
> Reviewed-by: Alberto Garcia <address@hidden>
> Reviewed-by: Max Reitz <address@hidden>
> Signed-off-by: Daniel P. Berrange <address@hidden>
> ---
> docs/specs/qcow2.txt | 96
> ++++++++++++++++++++++++++++++++++++++++++++++++++++
> 1 file changed, 96 insertions(+)
>
> +
> +The first 592 bytes of the header clusters will contain the LUKS
> +partition header. This is then followed by the key material data areas.
> +The size of the key material data areas is determined by the number of
> +stripes in the key slot and key size. Refer to the LUKS format
> +specification ('docs/on-disk-format.pdf' in the cryptsetup source
> +package) for details of the LUKS partition header format.
> +
> +In the LUKS partition header, the "payload-offset" field will be
> +calculated as normal for the LUKS spec. ie the size of the LUKS
> +header, plus key material regions, plus padding, relative to the
> +start of the LUKS header. Its value is never used in the context
> +of qcow2, however, since the qcow2 file format itself defines where
> +the real payload offset is.
Is it possible/valid for the LUKS payload-offset field to NOT be
qcow2-cluster-aligned? (I'm guessing yes, for example, if we have 2M
clusters; and that we don't care, because you documented that we don't
actually use that offset). Is it worth documenting this?
> +== Data encryption ==
> +
> +When an encryption method is requested in the header, the image payload
> +data must be encrypted/decrypted on every write/read. The image headers
> +and metadata is never encrypted.
s/is/are/
> +
> +The algorithms used for encryption vary depending on the method
> +
> + - AES:
> +
> + The AES cipher, in CBC mode, with 256 bit keys.
> +
> + Initialization vectors generated using plain64 method, with
> + the virtual disk sector as the input tweak.
Worth documenting that implementations should avoid creating new images
with this encryption (ie. make it officially part of the spec that this
is not recommended, but merely documented for back-compat data
liberation purposes)?
Reviewed-by: Eric Blake <address@hidden>
--
Eric Blake, Principal Software Engineer
Red Hat, Inc. +1-919-301-3266
Virtualization: qemu.org | libvirt.org
signature.asc
Description: OpenPGP digital signature
- [Qemu-block] [PATCH v7 04/20] qcow: require image size to be > 1 for new images, (continued)
- [Qemu-block] [PATCH v7 04/20] qcow: require image size to be > 1 for new images, Daniel P. Berrange, 2017/05/25
- [Qemu-block] [PATCH v7 05/20] iotests: skip 042 with qcow which dosn't support zero sized images, Daniel P. Berrange, 2017/05/25
- [Qemu-block] [PATCH v7 06/20] iotests: skip 048 with qcow which doesn't support resize, Daniel P. Berrange, 2017/05/25
- [Qemu-block] [PATCH v7 08/20] qcow: make encrypt_sectors encrypt in place, Daniel P. Berrange, 2017/05/25
- [Qemu-block] [PATCH v7 07/20] block: deprecate "encryption=on" in favor of "encrypt.format=aes", Daniel P. Berrange, 2017/05/25
- [Qemu-block] [PATCH v7 09/20] qcow: convert QCow to use QCryptoBlock for encryption, Daniel P. Berrange, 2017/05/25
- [Qemu-block] [PATCH v7 10/20] qcow2: make qcow2_encrypt_sectors encrypt in place, Daniel P. Berrange, 2017/05/25
- [Qemu-block] [PATCH v7 12/20] qcow2: extend specification to cover LUKS encryption, Daniel P. Berrange, 2017/05/25
- Re: [Qemu-block] [PATCH v7 12/20] qcow2: extend specification to cover LUKS encryption,
Eric Blake <=
- [Qemu-block] [PATCH v7 11/20] qcow2: convert QCow2 to use QCryptoBlock for encryption, Daniel P. Berrange, 2017/05/25
- [Qemu-block] [PATCH v7 14/20] qcow2: add iotests to cover LUKS encryption support, Daniel P. Berrange, 2017/05/25
- [Qemu-block] [PATCH v7 15/20] iotests: enable tests 134 and 158 to work with qcow (v1), Daniel P. Berrange, 2017/05/25
- [Qemu-block] [PATCH v7 13/20] qcow2: add support for LUKS encryption format, Daniel P. Berrange, 2017/05/25
- [Qemu-block] [PATCH v7 16/20] block: rip out all traces of password prompting, Daniel P. Berrange, 2017/05/25
- [Qemu-block] [PATCH v7 17/20] block: remove all encryption handling APIs, Daniel P. Berrange, 2017/05/25
- [Qemu-block] [PATCH v7 18/20] block: pass option prefix down to crypto layer, Daniel P. Berrange, 2017/05/25