Skip site navigation (1)Skip section navigation (2) 
Date:      Sat, 14 May 2016 21:13:59 +0100
From:      "Niall Douglas" <s_sourceforge@nedprod.com>
To:        freebsd-fs@freebsd.org
Subject:   Re: State of native encryption in ZFS
Message-ID:  <57378707.19425.B54772B@s_sourceforge.nedprod.com>
In-Reply-To: <0CE6E456-CC25-4AED-A73E-F5BBE659F795@mail.turbofuzz.com>
References:  <5736E7B4.1000409@gmail.com>, <0CE6E456-CC25-4AED-A73E-F5BBE659F795@mail.turbofuzz.com>
next in thread | previous in thread | raw e-mail | index | archive | help 

[-- Attachment #1 --]
On 14 May 2016 at 11:03, Jordan Hubbard wrote:

> It’s not even clear how that encryption would be implemented or exposed.
>  Per pool?  Per dataset?  Per folder?  Per file?  There have been
> requests for all of the above at one time or another, and the key
> management challenges for each are different.  They can also be
> implemented at a layer above ZFS, given sufficient interest.

If FreeBSD had a bigger PATH_MAX then stackable encryptions layers
like ecryptfs (encfs?) would be viable choices. Because encrypted
path components are so long, one runs very rapidly into the maximum
path on the system when PATH_MAX is so low.

I ended up actually installing ZFS on Linux with ecryptfs on top to
solve this. Every 15 minutes it ZFS snapshot syncs with the FreeBSD
edition. This works very well, apart from the poor performance of ZFS
on Linux.

ZFS handles long paths with ease. FreeBSD currently does not :(

Niall

--
ned Productions Limited Consulting
http://www.nedproductions.biz/
http://ie.linkedin.com/in/nialldouglas/



[-- Attachment #2 --]
0	*H
010	+0	*H
040 0
	*H
0}10	UIL10U

StartCom Ltd.1+0)U"Secure Digital Certificate Signing1)0'U StartCom Certification Authority0
071024210255Z
171024210255Z010	UIL10U

StartCom Ltd.1+0)U"Secure Digital Certificate Signing1806U/StartCom Class 2 Primary Intermediate Client CA0"0
	*H
0
(E,3*
U]"gFSݤ>}m
w鞆FA7~
|-ql"/Q?Vp`G&viĜ73{B'87ds	Nfz1%TII|2o/mD \t	:08VGqǴ3Rp}JTzF;&X}rD Q600U00U0UUo1ʹk1㬻0U#0N@[i04hCA0f+Z0X0'+0http://ocsp.startssl.com/ca0-+0!http://www.startssl.com/sfsca.crt0[UT0R0'%#!http://www.startssl.com/sfsca.crl0'%#!http://crl.startssl.com/sfsca.crl0U y0w0u+70f0.+"http://www.startssl.com/policy.pdf04+(http://www.startssl.com/intermediate.pdf0
	*H
:'
ӴiiL\};JBG
Ƚ1FagR~9P1 Rvg}ȜsWr<];sY/Msߟq'ɽNpʧ`&pPz/ў-Eׁ1KeET5ꥊ@v錈{8@t	e=ރt92Ow[%[kd+YO!_uyGYqE\pCbM~
@3xnM+RH?o'V=INjWbᑶYOuZk*9Jz)w󫦒jNnZqwZV=t+΄BMkd"ܧfVSąmzLu8¾ņVcoiQ^7|#Bl@/D;+@8	~brA+}TLVŜ2J(Hn}Rt]fiZ
U	]+nŚܓqEF$^fsȕP)*6\q)90y0aO0
	*H
010	UIL10U

StartCom Ltd.1+0)U"Secure Digital Certificate Signing1806U/StartCom Class 2 Primary Intermediate Client CA0
140719052958Z
160718215539Z010U
69RIG4j6M7fi54TD10	UIE1
0UCork10U
Kerry Pike10U
Niall Douglas1(0&	*H
	s_sourceforge@nedprod.com0"0
	*H
0
WNƼ@OSStu[VnoCzdJxBJ]&"ls84\q"-q&khDf/x2Cg{?$$\\&6CǪl!7@F
b:T6$NG
qdw2ezvɱZR$k$pCw`?EjJ2X3Dn&ƴ;xbo!U)c7'kܥ`P5w9iֿhoJ5V>dM9٪<:qaC
\NAǦ^	v'l4MVfć{q*%INJǵ*.D6PP5q(9s|{;JtBp*!\jq͊6nwb6ec?k)z3<^R/3cU;~W"<KsR&4V`p6^}"/X\00	U00U0U%0++0Ui/=y|'&d:*0U#0Uo1ʹk1㬻0$U0s_sourceforge@nedprod.com0LU C0?0;+70*0.+"http://www.startssl.com/policy.pdf0+00' StartCom Certification Authority0This certificate was issued according to the Class 2 Validation requirements of the StartCom CA policy, reliance only for the intended purpose in compliance of the relying party obligations.06U/0-0+)'%http://crl.startssl.com/crtu2-crl.crl0+009+0-http://ocsp.startssl.com/sub/class2/client/ca0B+06http://aia.startssl.com/certs/sub.class2.client.ca.crt0#U0http://www.startssl.com/0
	*H
~<;ُeH-z*#KTOq~	p@hp?zᤅx*C{M2ܥjҹݕ߭9I>UgM7ƞ
TOeD(^Rp9TZŢ	w*uֵb<=B*{yc5EpYګgm`BF/sP▥X:*'1Zz(UV19>:%g]g*Wya0jkGvŖ000
	*H
0}10	UIL10U

StartCom Ltd.1+0)U"Secure Digital Certificate Signing1)0'U StartCom Certification Authority0
060917194636Z
360917194636Z0}10	UIL10U

StartCom Ltd.1+0)U"Secure Digital Certificate Signing1)0'U StartCom Certification Authority0"0
	*H
0
	lF|x{3rb6 "$^wC
d̎68#nm<r=3+/AYg}
tyL7z9RYFC҅qub4,4ǖR=3M;JK&/r5w<]&6v\t%x-0-ryF*I
cSb:̵fkt+v>mDsb;ľSV%lQ	ʿvmۿ=fVH:KߧXP8u[ClMp[)eݪ]̯1ҍ{n'fHnB?!>{
pclT\%zɢɋ,~^MXn
2n6IHi–Mi
y"H{ipz7
vOW`g:ԋr"Ɵƶ\R<*s
`z/ۣn&0݉W=+ŷv+*r3]	K߻tRKR0N0U00U0UN@[i04hCA0dU]0[0,*(&http://cert.startcom.org/sfsca-crl.crl0+)'%http://crl.startcom.org/sfsca-crl.crl0]U T0P0L+70;0/+#http://cert.startcom.org/policy.pdf05+)http://cert.startcom.org/intermediate.pdf0+00' Start Commercial (StartCom) Ltd.0Limited Liability, read the section *Legal Limitations* of the StartCom Certification Authority Policy available at http://cert.startcom.org/policy.pdf0	`HB08	`HB
+)StartCom Free SSL Certification Authority0
	*H
lf4Ѕ^}
N8^ߦ%K2;=D	[I)f%	<6+Kh9f=&9Q{~ZWpi^X
ߌE8
^Wbz)n(DÐ8<CMdE(\s{諱.\dns1:}Q;Mf{<ӚePu/CiyCFrd6%8w~kjDKx,KD4R'
]xS2݀fuٵh(a.8gd./pǖ|eCTݥ9`4ɖp,H{~k";*RKU"4N&",uJ}׸d6/#	;sIjWxřCcMw-eriG	V$yX.	~m>J9+u	U77Cb VKel$$4"}?eQ
0j
r^100010	UIL10U

StartCom Ltd.1+0)U"Secure Digital Certificate Signing1806U/StartCom Class 2 Primary Intermediate Client CAO0	+]0	*H
	1	*H
0	*H
	1
160514201400Z0#	*H
	1tB3[ԛe-u0
	*H
P^Srd_!7w;ig~
eX9&|C_S3Q]ZѵBwk5.=qF1g9S]!m2̇&hh'^H-
36*ԟO}R.&?Dt3qû[q;ٝ\#:zb+,rVO`jг=#Yʓ(22;*֥ک]	䌴¹;kaD`oT2Th(@P'mPbu'ςVqIx&R	aekUH=q&㶉^&:K-r[;PgE3x@<9,acf1Ev2=WҲȒsU0;Bok5
yrr
K鬝;6#>lڊ08)OUug>KeNTP]nR}0,3pڟ:-ICMvZgu.o1c

Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?57378707.19425.B54772B>