IAM ==== Name: ZFS Encrypted Datasets Submitter: Darren Moffat Owner: Darren Moffat Intern: Garrett D'Amore Interest: Status: commitment scheduled 01/30/2008 Exposure: open Comment: inception held 07/11/2007 SUMMARY ======= This project will provide on disk encryption/decryption support for ZFS datasets. The project will cover the addition of encryption and decryption to the ZFS IO pipeline and the key management for ZFS datasets. It will deliver in multiple phases to support different key management strategies including one which provides support for secure file/data deletion based on encrypted datasets. Project team reviewed issues from inception (below) to ensure they have been resolved. Summary of reponse below. ISSUES ======= PSARC 2007/261: ZFS Encrypted Datasets Submitter: Darren Moffat Owner: Darren Moffat Intern: Garrett D'Amore Issues for inception (07/11/2007): jdc-1 Since ZIO_CRYPT_ON is equal to ZIO_CRYPT_AES_128_CBC, what usage does "on" support? Does "on" mean "most likely usable," or "fastest," or "most secure," or "best for this release," or what? ====> On is most secure mode and best for this release. On provides user via user interface to turn ZFS on. The other mode we support is ZIO_CRYPT_AES_128_CBC. jdc-2 Doesn't IEEE P1619 define other methods for disk encryption (XTS-AES)? What's the relationship between this project and the standards process? ====> LRW mode was discussed and rejected. On advice of cryptographers, XTS mode was too much overhead and does not give anything additional to XTS. XTS mode is non- expanding and is block size. P1619 is useful for encrypted dual bit encryption. This project is not about dual bit encryption. jdc-3 What should a user know (if anything) in order to choose an encryption mode? What will the documentation say about CCM and CBC? ====> During the lifetime of ZFS the encruypted mode will change while algorithm stays the same. We need to expose the encrypted mode for flexibility. jdc-4 What operational effect occurs to a ZFS file system when the key is deliberately destroyed or regenerated? Does "zfs mountall -a" fail at boot time (and make the system inoperable due to filesystem/local not coming on line)? Does ZFS know when to treat a destroyed data set as "empty?" ====> If the encryption key is not avail the dataset fails to mount. It will not cause boot to fail. The ZFS can find the structure and destroy the dataset. ged-1 Has the project team considered "plausible deniability"? Is there any meta data on the disks which could be used to distinguish the presence of random garbage from encrypted data? ====> wes-1 Need a clear statement of threat model of phase 1 in materials, please. It's impossible to judge whether you've succeeded in adding confidentiality and integrity protection to ZFS which is robust in the face of threats to the underlying storage without clearly describing the threats you've considered. ====> Spec outlines requirements. wes-2 nit: requirements as phrased imply zfs encryption will always be enabled, which is inconsistent with the rest of the document wes-3 section 3.3 (encrypted zvol for swap) appears to be out of synch with the plan for zfs swap/dump proposed in 2006/370 (which involves a new pseudo-disk device backed by preallocated pool space (with no CoW); please synch up with that team soon, and ideally before either project comes for commitment review. ====> If you have an encrypted zvol you will have an encrypted swap. Darren to include in opinion to have an encrypted zfs ... wes-4 Fine details of algorithm usage need to be nailed down early (especially details around choice of initialization vectors or equivalent) so they can be reviewed by experienced cryptographers. please include these details and information about who's reviewed them (and what these reviewers said..) as part of the commitment spec. (see also my design review comments re: allowing a trusted encryption module to pick all the security-relevent parameters such as the IV). ====> Never reuse an IV. Will never regenerate the same IV. wes-5 can you briefly describe how you'd recover from a key compromise? ====> It depends on what the comprise was. If the encryption key was uwrapped, the organization should have a procedure to send a message back. wes-6 can you briefly describe how you'd receover after a key was lost unretrievably? ====> Design the CLI such that you can store files. Ensure private libraries can be rebuilt via pass by value or by reference. wes-7 I was expecting to see either a revised version of the ZFS on-disk format spec with encryption additions, or an addendum to that spec explaining precisely which on-disk structures are encrypted and how. ====> If the user logs out the dataset remains mounted. The system reboots and does not login and home dir is encrypted, then the dir is not available. In meeting issues: gw-1 What is the story around key recovery (key escrow)? ====> Designed the CLI to store keys...in files... The key can be passed to library calls by actual values or by reference. The key escrow becomes a later phase of this project. Not a necessary feature for this phase per customer requirements other requirments. gw-2 How will delayed execution work if $HOME is encrypted, the user is logged out, the system reboots? ====> If users $HOME is encrypted user and logs out their dataset is still mounted. When systrm reboots and user does not log back in and the user homedir is encryped with a key that user only knows, then home dir is not avail . If You need cron jobs to run when your home dir is encrypted, then refer to the other case that cames to the ARC. gw-3 What is the interaction with the user/admin for unwrapping the pool keys? Is it automatic during login? Is it something like /etc/.rootkey? How is trusted path preserved? ====> There is no interaction with login/out process. In most cases users login to see if there home dir is mounted. There are 2 delegation keys provided and those are in the documentation. How path is preserved is not relevant...it may be a piece of Advice. ged-2 What is the interaction of encrypted data sets with zpool import and export? ====> When you do an import, you line up the datasets among other things and any key that is not present is not mounted. Export is run by filesystem, there is no change for export. If key is present, we don't have zpool import and do a key load; we have the admin to do an explicit load. VOTE ==== Approve - Darren Moffat, Glenn Skinner, Joe Kowalski, Mark Carlson, Kais Belgaied Deny - Abstain - Not Participating (NP) - Tim Marsland THE NEXT STEP ============= No TCRs, TCAs. 31M:30S ADVICE: Security team and team responsible for Solaris virtual memory implementation should investigate/implement a proper encryption slot loader. Darren to draft opinion.