Re: [Qemu-devel] qemu-img create encryption

[Daniel P. Berrange]

On Thu, Jun 27, 2013 at 08:05:38AM -0400, Hamilton, Peter A. wrote:
> > It also means you can't change the password of an existing image - you have 
> > to create a new image with a new password & re-encrypt the data.
> 
> Following up on this point, since "qemu-img create" cannot be used to specify 
> a password, is "qemu-img convert" the only command that can be used to 
> provide 

Any command which actually reads/writes data will take a password. So, yes,
I'd expect 'convert' to ask for one.

> one? Furthermore, since "convert" conducts a full copy of the source image, 
> does this mean that it is not possible to have an encrypted CoW image with an 
> encrypted backing file, where each is encrypted with a different password? 
> The 
> tests I have conducted up to this point seem to indicate that this is true.

I'm honestly not too sure about the status of encryption wrt backing stores.
I wouldn't surprise me if you needed to use the same password for both the
top & lower level backing files. Equally though, there's no technical reason
why this should be required - just an impl limitation, if true.


Daniel
-- 
|: http://berrange.com      -o-    http://www.flickr.com/photos/dberrange/ :|
|: http://libvirt.org              -o-             http://virt-manager.org :|
|: http://autobuild.org       -o-         http://search.cpan.org/~danberr/ :|
|: http://entangle-photo.org       -o-       http://live.gnome.org/gtk-vnc :|