Date: Fri, 17 Sep 2010 21:29:38 +0200 From: Pawel Jakub Dawidek <pjd@FreeBSD.org> To: Andriy Bakay <andriy@irbisnet.com> Cc: "freebsd-fs@freebsd.org" <freebsd-fs@freebsd.org> Subject: Re: ZFS + GELI data integrity Message-ID: <20100917192938.GB1902@garage.freebsd.pl> In-Reply-To: <op.vi433pxp6f601j@prime.irbisnet.com> References: <op.vi433pxp6f601j@prime.irbisnet.com>
next in thread | previous in thread | raw e-mail | index | archive | help
--JP+T4n/bALQSJXh8 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Thu, Sep 16, 2010 at 03:22:27PM -0400, Andriy Bakay wrote: > Hi list(s), >=20 > I am using ZFS on top of GELI. Does exists any practical reason to enable= =20 > GELI data authentication (data integrity) underneath of ZFS? I understand= =20 > GELI data integrity is cryptographically strong -- up to HMAC/SHA512, but= =20 > ZFS has SHA256 checksum. GELI linked data to sector and will detect if = =20 > somebody move data around, but my understanding is to move data around = =20 > consistently one need to decrypt it which is very difficult. Correct me i= f =20 > I wrong. >=20 > Any thoughts? ZFS blocks form z merkle tree (http://en.wikipedia.org/wiki/Hash_tree), so if you're using cryptographically strong hash, like sha256 within your pool, I believe it is safe not to use GELI data authentication, but only encryption. Note, that I'm not cryptographer and this is quite complex scenario, so what I believe in here might not be true. Alternatively you could use GELI authetication and turn off ZFS checksum. When I personally use ZFS on top of GELI, I do just that: GELI does encryption only and ZFS does authentication with SHA256 checksum. --=20 Pawel Jakub Dawidek http://www.wheelsystems.com pjd@FreeBSD.org http://www.FreeBSD.org FreeBSD committer Am I Evil? Yes, I Am! --JP+T4n/bALQSJXh8 Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.14 (FreeBSD) iEYEARECAAYFAkyTwaEACgkQForvXbEpPzQIbQCgjA89ID5Jep0BoeeC2kilB8j7 Of4AnRqOnbvFwRE1t+iFkfkCAVXbbofG =sLC7 -----END PGP SIGNATURE----- --JP+T4n/bALQSJXh8--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20100917192938.GB1902>