Date: Sun, 15 May 2016 11:45:42 +0100 From: "Niall Douglas" <s_sourceforge@nedprod.com> To: "freebsd-fs@FreeBSD.org" <freebsd-fs@freebsd.org> Subject: Re: State of native encryption in ZFS Message-ID: <57385356.4525.E728971@s_sourceforge.nedprod.com> In-Reply-To: <CAHM0Q_PGvBRbUFOhmin4RKaDKRTRJyjieuaZ5_tjPerK4eRz=w@mail.gmail.com> References: <5736E7B4.1000409@gmail.com>, <57378707.19425.B54772B@s_sourceforge.nedprod.com>, <CAHM0Q_PGvBRbUFOhmin4RKaDKRTRJyjieuaZ5_tjPerK4eRz=w@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
[-- Attachment #1 --] On 14 May 2016 at 16:09, K. Macy wrote: > >> It’s not even clear how that encryption would be implemented or exposed. > >> Per pool? Per dataset? Per folder? Per file? There have been > >> requests for all of the above at one time or another, and the key > >> management challenges for each are different. They can also be > >> implemented at a layer above ZFS, given sufficient interest. > > > > If FreeBSD had a bigger PATH_MAX then stackable encryptions layers > > like ecryptfs (encfs?) would be viable choices. Because encrypted > > path components are so long, one runs very rapidly into the maximum > > path on the system when PATH_MAX is so low. > > > > I ended up actually installing ZFS on Linux with ecryptfs on top to > > solve this. Every 15 minutes it ZFS snapshot syncs with the FreeBSD > > edition. This works very well, apart from the poor performance of ZFS > > on Linux. > > > > ZFS handles long paths with ease. FreeBSD currently does not :( > > AFAICT that's a 1 line patch. Have you tried patching that and > rebuilding kernel, world, and any vulnerable ports? The problem is apparently kernel structure bloat and that they want to remove fixed maximum paths altogether so it would be boot modifiable. http://freebsd.1045724.n5.nabble.com/misc-184340-PATH-MAX-not-interope rable-with-Linux-td5864469.html As laudable as the latter goal is, unfortunately OS X and Linux hard code theirs, and much POSIX software will use whatever PATH_MAX is set to. I'm therefore not sure the implementation cost is worth it. In any case, a 1024 byte path limit is just 256 unicode characters potentially. That's worse than Windows 95 :( Niall -- ned Productions Limited Consulting http://www.nedproductions.biz/ http://ie.linkedin.com/in/nialldouglas/ [-- Attachment #2 --] 0 *H 01 0 + 0 *H 040 0 *H 0}1 0 UIL10U StartCom Ltd.1+0)U "Secure Digital Certificate Signing1)0'U StartCom Certification Authority0 071024210255Z 171024210255Z01 0 UIL10U StartCom Ltd.1+0)U "Secure Digital Certificate Signing1806U/StartCom Class 2 Primary Intermediate Client CA0"0 *H 0 (E,3* U]"gFSݤ>}m w鞆 FA7~ |-ql"/Q?Vp `G&viĜ73 {B'87ds N fz 1%TII|2o/mD \ t :08VGqǴ3Rp}JTzF;&X}rD Q 6 00U 00U 0 U Uo1ʹ k1 㬻0 U #0N @[i04hCA0f+Z0X0'+0http://ocsp.startssl.com/ca0-+0!http://www.startssl.com/sfsca.crt0[U T0R0'%#!http://www.startssl.com/sfsca.crl0'%#!http://crl.startssl.com/sfsca.crl0U y0w0u +70f0.+"http://www.startssl.com/policy.pdf04+(http://www.startssl.com/intermediate.pdf0 *H :' ӴiiL\};JBG Ƚ1Fa gR~9P1 Rvg}ȜsWr<];s Y/Msߟq'ɽNpʧ`&pPz/ў -Eׁ1KeET5ꥊ@v錈 {8@t e = ރt92Ow[%[kd+YO!_uyGYqE\pCbM~ @3xnM+RH?o'V=INjWbᑶYOuZk*9Jz)wjNnZqwZV=t+΄BMkd"ܧfVSąmzLu8¾ņVcoiQ^7|#Bl@ /D;+@8 ~brA+}TLVŜ 2J (Hn} Rt] fiZ U ]+nŚܓq EF$^fsȕP)*6\q)90y0aO0 *H 01 0 UIL10U StartCom Ltd.1+0)U "Secure Digital Certificate Signing1806U/StartCom Class 2 Primary Intermediate Client CA0 140719052958Z 160718215539Z010U 69RIG4j6M7fi54TD1 0 UIE1 0 UCork10U Kerry Pike10U Niall Douglas1(0& *H s_sourceforge@nedprod.com0"0 *H 0 WNƼ @OSStu[VnoCzdJxBJ]&"ls84\q"-q&khDf/x 2Cg{?$$ \\&6CǪl!7@F b:T6$NG qdw2ezvɱZR$k$pC w`?EjJ2X3Dn&ƴ;xbo!U)c7' kܥ `P5w9iֿhoJ5V>dM9٪<:qaC \NAǦ^ v'l4MVfć{q* %INJǵ*.D6PP5q(9 s|{;JtBp*!\jq͊6nwb6ec?k)z3<^R/3cU ;~W"<KsR&4V`p6^}"/X\ 00 U 0 0 U 0 U %0++0 U i/=y|'&d:*0 U #0Uo1ʹ k1 㬻0$U 0s_sourceforge@nedprod.com0LU C0?0; +70*0.+"http://www.startssl.com/policy.pdf0+00' StartCom Certification Authority0This certificate was issued according to the Class 2 Validation requirements of the StartCom CA policy, reliance only for the intended purpose in compliance of the relying party obligations.06U /0-0+)'%http://crl.startssl.com/crtu2-crl.crl0+009+0-http://ocsp.startssl.com/sub/class2/client/ca0B+06http://aia.startssl.com/certs/sub.class2.client.ca.crt0#U 0http://www.startssl.com/0 *H ~<;ُeH-z*#KT Oq~ p@hp?zᤅx*C{M2ܥjҹݕ߭9I>Ug M7ƞ TOeD(^Rp9TZŢ w*uֵb<=B*{yc5Ep Yګgm`BF/sP▥X:*'1Zz(UV19>:%g]g*W ya0jkGv Ŗ000 *H 0}1 0 UIL10U StartCom Ltd.1+0)U "Secure Digital Certificate Signing1)0'U StartCom Certification Authority0 060917194636Z 360917194636Z0}1 0 UIL10U StartCom Ltd.1+0)U "Secure Digital Certificate Signing1)0'U StartCom Certification Authority0"0 *H 0 lF|x{3rb6 "$^wC d̎68#nm<r =3+/AYg} tyL7z9RYFC҅qub4, 4ǖR=3M ;JK&/ r5w<]&6v\t%x- 0-ryF*I cSb:̵fkt+v>mDsb ;ľSV%lQ ʿvmۿ=f VH:KߧXP8u[C lMp[)eݪ]̯1 ҍ{n'f HnB?!>{ pclT\%zɢɋ,~^MXn 2n6IHiMi y"H{ipz7 vOW`g:ԋr"Ɵƶ\R<*s `z/ۣn&0݉W=+ŷv+*r3] KtRK R0N0 U 00 U 0 U N @[i04hCA0dU ]0[0,*(&http://cert.startcom.org/sfsca-crl.crl0+)'%http://crl.startcom.org/sfsca-crl.crl0]U T0P0L +70;0/+#http://cert.startcom.org/policy.pdf05+)http://cert.startcom.org/intermediate.pdf0+00' Start Commercial (StartCom) Ltd.0Limited Liability, read the section *Legal Limitations* of the StartCom Certification Authority Policy available at http://cert.startcom.org/policy.pdf0 `HB 08 `HB +)StartCom Free SSL Certification Authority0 *H lf 4Ѕ^} N8 ^ߦ%K2;=D [I)f% <6+Kh9f=&9 Q{~ZWpi^X ߌE8 ^Wbz )n(DÐ8<CMdE(\s{諱.\dns1:}Q;Mf{<Ӛ ePu/CiyCFrd6% 8w~kjDKx, KD4R' ]xS2݀fuٵh(a.8 gd./pǖ|eCTݥ9`4ɖp, H{ ~k";*RKU"4N&",uJ} d6/# ;sIjWxřCcMw-eriG V$ yX. ~m >J9+u U77Cb VKel$$4"}?eQ 0j r^10001 0 UIL10U StartCom Ltd.1+0)U "Secure Digital Certificate Signing1806U/StartCom Class 2 Primary Intermediate Client CAO0 + ]0 *H 1 *H 0 *H 1 160515104542Z0# *H 1^峥b7 3Lr]0 *H B ={TO Åy-p{6rMgx~='G % UBى"9ۙ V%wMta>-Է %ɞS^?>Ԇo{KP&'QbO韛GV>9RfglkNpz q YCc\ʎ ?gba ۔DfMB;dBy@iq)U*s #4w`%jc{V CQle<ŋ܂jf Lv'KP0)] &gBa@MLc#td5C! UVP ˼R^bȕOoIY7!'pxgRo TL ʥm^jM 9ߙօ;]{Pln>MlcDKϕ~fQ3!m"~FX n ,9pv%d|l<ƛ;
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?57385356.4525.E728971>