[Qemu-devel] Volume key in qcow3?

[Frediano Ziglio]

Hi,
  I noted that AES encryption using qcow2 just use the password given
as as key (and also truncating it to 16 bytes == 128 bits).
This is prone to brute force attacks and is not also easy to change
password (you have to decrypt and encrypt again the entire image).
LUKS and EncFS use another way. They generate a random key (the
"volume key") then use the password you give to encrypt N times (where
N is decided by security level or automatically based on time to
decrypt the volume key. To change the password just give the old one,
get the volume key and encrypt again using the new one. LUKS support
also multiple "slots" to allow multiple password and even using an
external key file.
Obviously this require an additional extension to qcow2 so I think it
require a new qcow3 format.

Frediano