encryption
Hello you guys,
it is possible to decrypt a kvm volume only by using the command line after starting it?
Best regards
Henry
Quoted 2 lines · Henry Noack
it is possible to decrypt a kvm volume only by using the command line after starting it?
Encryption can be done at 3 levels:
1. Inside the guest. Just like you do on a physical machine with LUKS (dm-crypt), ecryptfs, TrueCrypt, etc.
2. In QEMU with qcow2, although this feature is not widely used and not up to modern disk encryption standards.
3. On the host using LUKS (dm-crypt), ecryptfs, TrueCrypt, etc or on the storage appliance.
It depends what you are trying to achieve.
Keep in mind that encrypting the disk image does not stop the host from seeing inside the guest. The host is always trusted, today's virtualization technology has this limitation.
Stefan
Quoted 5 lines · Stefan Hajnoczi
Quoted 2 lines · Henry Noack
it is possible to decrypt a kvm volume only by using the command line after starting it?
Encryption can be done at 3 levels:
[...]
Quoted 2 lines
2. In QEMU with qcow2, although this feature is not widely used and not up to modern disk encryption standards.
Quoting the fine manual:
The use of encryption in qcow and qcow2 images is considered to be flawed by modern cryptography standards, suffering from a number of design problems:
− The AES-CBC cipher is used with predictable
initialization vectors based on the sector number. This makes it vulnerable to chosen plaintext attacks which can reveal the existence of encrypted data.
− The user passphrase is directly used as the encryption
key. A poorly chosen or short passphrase will compromise the security of the encryption.
− In the event of the passphrase being compromised there is
no way to change the passphrase to protect data in any qcow images. The files must be cloned, using a different encryption passphrase in the new file. The original file must then be securely erased using a program like shred, though even this is ineffective with many modern storage technologies.
Use of qcow / qcow2 encryption is thus strongly discouraged. Users are recommended to use an alternative encryption technology such as the Linux dm-crypt / LUKS system.
[...]