Thu, 15 Dec 2005
Luuking at LUKS
I am preparing a machine for remote backups. Because the backups may contain sensitive data, we have been thinking about storing the data on an encrypted filesystem. This allows us to do disaster recovery on the remote system without worrying about the data being compromised in case the box is stolen. So I have started to look for a suitable solution.
I knew that there is Crypto-loop, which has known security weaknesses. Then there is dm-crypt, which uses the in-kernel cryptographic API[?] and the Device-mapper to encrypt an arbitrary block device. However, I wanted something which would support multiple passphrases, and on-disk metadata (so that the passphrase-encrypted key does not need to be stored on a separate device, for example). I have found a project called LUKS - Linux Unified Key Setup - which provides the missing parts, like an open on-disk metadata format, which is even planned to be usable from The Other OS, Which Should Not Be Named.
Even more interesting is that the cryptsetup program in Fedora Core 4 is already built with support for LUKS. So the encrypted volume is just few commands away:
# cryptsetup luksFormat /dev/md1 --cipher blowfish --key-size 256 ... the passphrase is entered here ... # cryptsetup luksOpen /dev/md1 encrypted ... it asks for the passphrase, of course. # mke2fs -j /dev/mapper/encrypted # mount -t ext3 /dev/mapper/encrypted /mountpoint
I have measured that the overhead of the encryption is not so bad - it is definitely sufficient for backups sent over a 100Mbit/s ethernet. The raw speed of the underlying /dev/md1 device is about 60 MB/s of sequential read with close-to-zero CPU utilization, and the speed of /dev/mapper/encrypted is about 35 MB/s of sequential read with about 60% of CPU (AMD Athlon 3000+ with DDR 333 RAM).
1 replies for this story:
Vlastimil Holer wrote: FileVault
Filesystem encryption is a standard feature of Mac OS X called FileVault :-P