UBIFS Encryption
Hi,
I have the necessity to encrypt UBIFS - I have read that there is some movement about this, for example here:
http://lists.infradead.org/pipermail/linux-mtd/2016-March/066277.html
and some years ago there was another attempt:
https://patchwork.ozlabs.org/patch/150160/
It looks like from patchwork that the above patch was merged, but it is not. Anyway, this looks as a starting point to add encryption / decryption routine, for example using crypto hardware, to the compress / decompress functions. In my understanding (I have a i.MX6 with CAAM crypto hardware), this can be possible - but I am asking here if there are some progress and which could be the best long term solution.
Best regards,
Stefano Babic
Signature · 5 lines
===================================================================== DENX Software Engineering GmbH, Managing Director: Wolfgang Denk HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany Phone: +49-8142-66989-53 Fax: +49-8142-66989-80 Email: [email protected] =====================================================================
Richard Weinberger
maintainerHi!
Am 14.06.2016 um 11:51 schrieb Stefano Babic:
Quoted 10 lines
Hi,
I have the necessity to encrypt UBIFS - I have read that there is some movement about this, for example here:
http://lists.infradead.org/pipermail/linux-mtd/2016-March/066277.htmland some years ago there was another attempt:
https://patchwork.ozlabs.org/patch/150160/
File level encryption for UBIFS did not materialize yet because my customer decided against encryption and the project degraded to a "would be a nice to have feature I'll do in my spare time when I'm bored" state.
That said, the feature was requested a few times but nobody was willing to do a proper implementation nor fund it so far.
Quoted 6 lines
It looks like from patchwork that the above patch was merged, but it is not. Anyway, this looks as a starting point to add encryption / decryption routine, for example using crypto hardware, to the compress / decompress functions. In my understanding (I have a i.MX6 with CAAM crypto hardware), this can be possible - but I am asking here if there are some progress and which could be the best long term solution.
Please use the VFS approach like ext4 and f2fs do. That way a lot of existing infra structure can re-used. Think of key management.
Thanks,
//richard