Re: [Qemu-devel] Adding dmcrypt to QEMU block drivers

[Daniel P. Berrange]

On Thu, Mar 20, 2014 at 09:23:14AM +0100, Stefan Hajnoczi wrote:
> On Tue, Mar 18, 2014 at 01:30:44PM +0000, Daniel P. Berrange wrote:
> > On Tue, Mar 18, 2014 at 02:08:19PM +0100, Stefan Hajnoczi wrote:
> > > On Mon, Mar 17, 2014 at 08:48:08PM -0400, Hamilton, Peter A. wrote:
> > > I guess the filter would be deployed below the image format:
> > > qcow2 -> luks -> file
> > 
> > I could see it being either above or below the image format at
> > mgmt app's choice. Having it above the image format means only
> > the payload is encrypted, so you can still query the basic
> > metadata (like logic disk size, backing files) without decrypting,
> > which is a nice aspect of the way qcow2 encryption historically
> > worked. I could see though that people might want even the header
> > encrypted to prevent anyone seeing anything about the image format
> > without keys.
> 
> The difference is that if you encrypt just the payload then dmcrypt
> compatibility is much less useful since the data is now intermingled
> with image format metadata.

You do get some crazy apps which format a block device with qcow2
though - eg oVirt. So conceptually even doing qcow2 inside a
dmcrypt block could make some sense if apps like that setup!

Regards,
Daniel
-- 
|: http://berrange.com      -o-    http://www.flickr.com/photos/dberrange/ :|
|: http://libvirt.org              -o-             http://virt-manager.org :|
|: http://autobuild.org       -o-         http://search.cpan.org/~danberr/ :|
|: http://entangle-photo.org       -o-       http://live.gnome.org/gtk-vnc :|