From owner-freebsd-security@FreeBSD.ORG Fri Jun 9 13:04:31 2006 Return-Path: X-Original-To: freebsd-security@FreeBSD.org Delivered-To: freebsd-security@FreeBSD.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 8BB9D16A41B for ; Fri, 9 Jun 2006 13:04:31 +0000 (UTC) (envelope-from pjd@garage.freebsd.pl) Received: from mail.garage.freebsd.pl (arm132.internetdsl.tpnet.pl [83.17.198.132]) by mx1.FreeBSD.org (Postfix) with ESMTP id 302A743D79 for ; Fri, 9 Jun 2006 13:04:28 +0000 (GMT) (envelope-from pjd@garage.freebsd.pl) Received: by mail.garage.freebsd.pl (Postfix, from userid 65534) id B55CF5133B; Fri, 9 Jun 2006 15:04:27 +0200 (CEST) Received: from localhost (pjd.wheel.pl [10.0.1.1]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.garage.freebsd.pl (Postfix) with ESMTP id 0426B51307 for ; Fri, 9 Jun 2006 15:04:22 +0200 (CEST) Date: Fri, 9 Jun 2006 15:02:00 +0200 From: Pawel Jakub Dawidek To: freebsd-security@FreeBSD.org Message-ID: <20060609130159.GD95774@garage.freebsd.pl> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="a2FkP9tdjPU2nyhF" Content-Disposition: inline X-PGP-Key-URL: http://people.freebsd.org/~pjd/pjd.asc X-OS: FreeBSD 7.0-CURRENT i386 User-Agent: mutt-ng/devel-r535 (FreeBSD) X-Spam-Checker-Version: SpamAssassin 3.0.4 (2005-06-05) on mail.garage.freebsd.pl X-Spam-Level: X-Spam-Status: No, score=-5.9 required=3.0 tests=ALL_TRUSTED,BAYES_00 autolearn=ham version=3.0.4 Cc: Subject: Data authentication for geli(8) committed to HEAD. X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 09 Jun 2006 13:04:31 -0000 --a2FkP9tdjPU2nyhF Content-Type: text/plain; charset=iso-8859-2 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Hi. geli(8) from FreeBSD-CURRENT is now able to perform data integrity verification (data authentication) using one of the following algorithms: - HMAC/MD5 - HMAC/SHA1 - HMAC/RIPEMD160 - HMAC/SHA256 - HMAC/SHA384 - HMAC/SHA512 One of the main design goals was to make it reliable and resistant to power failures or system crashes. This was very important to commit both data update and HMAC update as an atomic operation to the disk, so users don't have to fight with false positives. Even with data authentication enabled, geli(8) should still be fast - to provide the reliability I'm talking on internal journal or other complex mechanisms are used. It is still sector-to-sector encryption. If someone is interested in the data layout itself, it is described in the sys/geom/eli/g_eli_integrity.c file. Before you use this feature, please read "DATA AUTHENTICATION" section in the geli(8) manual page, to learn against which kind of attacks geli(8) can protect your data and against which it can not. While working on this, I improved crypto(9) framework a bit and various drivers. At this point, all crypto accelerators, which we support should work with geli(8) (ubsec(4), hifn(4), safe(4), padlock(4)), also with data authentication functionality. Enjoy! The work was sponsored by Wheel LTD. [http://www.wheel.pl], creator of authentication system - CERB - which allows to use mobile phone/device in two-factor authentication process. --=20 Pawel Jakub Dawidek http://www.wheel.pl pjd@FreeBSD.org http://www.FreeBSD.org FreeBSD committer Am I Evil? Yes, I Am! --a2FkP9tdjPU2nyhF Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2 (FreeBSD) iD8DBQFEiXFHForvXbEpPzQRAnr+AKDqfjQq3RnPRUXsyL226G/pwfczjQCfatoC XoVbt/7nwJnN35Vfzt/cabc= =ZMPB -----END PGP SIGNATURE----- --a2FkP9tdjPU2nyhF--