Re: [Gnu-arch-users] Re: archive encryption

[Robin Green]

On Sat, May 08, 2004 at 10:46:29AM +0200, Johannes Berg wrote:
> Another plan which I pursued for a while but had to give up due to time
> constraints for the time being was to encrypt everything (excluding the
> meta-info stuff), and even mangle the archive format in a way that also
> makes category names etc. unreadable.

There is no need[0] to reimplement CFS.[1] CFS encrypts file contents and names
(and metadata too IIRC). It worked quite well for me as an
encrypted filesystem (well, until I lost a hard drive and tried to restore
from an encrypted backup. Hint: Don't naively tar cvf the backing store for
a CFS filesystem, it won't work as a backup. At least, it didn't for me.)

Of course, you would need to use *two* layers of NFS in the proposed scenario
- CFS (which speaks NFS) on the client, and ordinary NFS on the server -
which is kind of yucky - but once you had it setup and working, it wouldn't
require any coding.
-- 
Robin

[0] Well, except for the fact that CFS is non-Free, and now only available in
the US and Canada because of export control paranoia :)

[1] http://www.crypto.com/papers/cfs.announce

pgpee82NgWeLK.pgp
Description: PGP signature