Re: ZFS Crypto key hand off to kernel

[Vladimir 'φ-coder/phcoder' Serbinenko]

On 10.01.2012 13:23, Darren J Moffat wrote:
> I've been testing the ZFS Crypto support in GRUB2 with Solaris 11 and 
> found it works great - many thanks!
>
> The 'zfskey' command works very nicely, however the key is only 
> available to grub and isn't handed off to the kernel that GRUB2 starts 
> up.
>
> I'm considering an extension to the multiboot2 spec to provide a 
> mechanism to hand off the key from GRUB2 to the running kernel.
>
> I would like for this not to be specific to the ZFS crypto support but 
> to be usable for LUKS and other systems that allow for an encrypted 
> root/boot where both GRUB2 and the kernel need the same key.
>
> Is this something that would be of interest for GRUB2 ?  If so I'll 
> look at developing the spec update and a patch for GRUB2 to support it 
> for the zfs crypto support.
That would be most welcome. The main issues are:
1) What to consider a key? IMHO it should be the master key, and not 
password or session key.
2) How to match keys to actual devices? I think it should be UUID for 
LUKS and POOLUUID+FSNAME for ZFS, or perhaps just POOLUUD.
3) GRUB may have some keys without knowing which pool/fs it's used for. 
They should be marked as such.


--
Regards
Vladimir 'φ-coder/phcoder' Serbinenko