[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] Adding dmcrypt to QEMU block drivers
From: |
Daniel P. Berrange |
Subject: |
Re: [Qemu-devel] Adding dmcrypt to QEMU block drivers |
Date: |
Thu, 20 Mar 2014 12:41:12 +0000 |
User-agent: |
Mutt/1.5.21 (2010-09-15) |
On Thu, Mar 20, 2014 at 09:23:14AM +0100, Stefan Hajnoczi wrote:
> On Tue, Mar 18, 2014 at 01:30:44PM +0000, Daniel P. Berrange wrote:
> > On Tue, Mar 18, 2014 at 02:08:19PM +0100, Stefan Hajnoczi wrote:
> > > On Mon, Mar 17, 2014 at 08:48:08PM -0400, Hamilton, Peter A. wrote:
> > > I guess the filter would be deployed below the image format:
> > > qcow2 -> luks -> file
> >
> > I could see it being either above or below the image format at
> > mgmt app's choice. Having it above the image format means only
> > the payload is encrypted, so you can still query the basic
> > metadata (like logic disk size, backing files) without decrypting,
> > which is a nice aspect of the way qcow2 encryption historically
> > worked. I could see though that people might want even the header
> > encrypted to prevent anyone seeing anything about the image format
> > without keys.
>
> The difference is that if you encrypt just the payload then dmcrypt
> compatibility is much less useful since the data is now intermingled
> with image format metadata.
You do get some crazy apps which format a block device with qcow2
though - eg oVirt. So conceptually even doing qcow2 inside a
dmcrypt block could make some sense if apps like that setup!
Regards,
Daniel
--
|: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :|
|: http://libvirt.org -o- http://virt-manager.org :|
|: http://autobuild.org -o- http://search.cpan.org/~danberr/ :|
|: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|