From sacadmin Wed Jul 18 13:06:24 2007 Received: from sunmail4.Singapore.Sun.COM (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l6IK6N4L001982 for ; Wed, 18 Jul 2007 13:06:23 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail4.Singapore.Sun.COM (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id l6IK4Bjt025595; Thu, 19 Jul 2007 04:04:19 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JLE00G055377800@nwk-avmta-2.sfbay.sun.com>; Wed, 18 Jul 2007 13:04:19 -0700 (PDT) Received: from sca-es-mail-1.sun.com ([192.18.43.132]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JLE00BXX536WG40@nwk-avmta-2.sfbay.sun.com>; Wed, 18 Jul 2007 13:04:18 -0700 (PDT) Received: from fe-sfbay-10.sun.com ([192.18.43.129]) by sca-es-mail-1.sun.com (8.13.7+Sun/8.12.9) with ESMTP id l6IK4IMl008967; Wed, 18 Jul 2007 13:04:18 -0700 (PDT) Received: from conversion-daemon.fe-sfbay-10.sun.com by fe-sfbay-10.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0JLE00J01518Z500@fe-sfbay-10.sun.com> (original mail from Cari.Towne@Sun.COM); Wed, 18 Jul 2007 13:04:18 -0700 (PDT) Received: from [129.145.154.81] by fe-sfbay-10.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0JLE0035L532FSG0@fe-sfbay-10.sun.com>; Wed, 18 Jul 2007 13:04:14 -0700 (PDT) Date: Wed, 18 Jul 2007 13:04:14 -0700 From: Cari Towne Subject: PSARC Meeting Minutes 07/11/2007 Inception 2007/261; Inception 2007/249 Sender: Cari.Towne@sun.com To: psarc@sun.com, Leann Pugsley , Rich Brown , Basabi Bhattacharya , Jerry Gilliam , bev.crair@sun.com, fred.zlotnik@sun.com, Philip Baker Message-id: <469E723E.5080906@Sun.COM> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=us-ascii Content-transfer-encoding: 7BIT X-Accept-Language: en-us, en X-PMX-Version: 5.2.0.264296 User-Agent: Mozilla/5.0 (X11; U; SunOS sun4v; en-US; rv:1.7) Gecko/20070109 Status: RO Content-Length: 669 All, Meeting minutes for 07/11/2007 are now available: (1) http://sac.eng/Archives/Minutes/PSARC/2007/20070711.arcbiz Audio: http://sac.eng/Archives/Minutes/PSARC/2007/20070711.arcbiz.mp3 2) http://sac.eng/Archives/Minutes/PSARC/2007/20070711.2007.261.inception Audio: http://sac.eng/Archives/Minutes/PSARC/2007/20070711.2007.261.inception.mp3 3) http://sac.eng/Archives/Minutes/PSARC/2007/20070711.2007.249.inception Audio: http://sac.eng/Archives/Minutes/PSARC/2007/20070711.2007.249.inception.mp3 Sum up available at: http://sac.eng/Archives/Minutes/PSARC/2007/20070711.html If you have any corrections/feedback, please direct them to me. Thanks, Cari From sacadmin Wed Jan 30 09:20:44 2008 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m0UHKhxE024043 for ; Wed, 30 Jan 2008 09:20:43 -0800 (PST) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id m0UHKPZq007879; Thu, 31 Jan 2008 01:20:37 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JVG0090RW6BWU00@nwk-avmta-2.sfbay.sun.com>; Wed, 30 Jan 2008 09:20:35 -0800 (PST) Received: from brmea-mail-4.sun.com ([192.18.98.36]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JVG007WYW6AZ540@nwk-avmta-2.sfbay.sun.com>; Wed, 30 Jan 2008 09:20:34 -0800 (PST) Received: from fe-amer-09.sun.com ([192.18.109.79]) by brmea-mail-4.sun.com (8.13.6+Sun/8.12.9) with ESMTP id m0UHKYLS020429; Wed, 30 Jan 2008 17:20:34 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0JVG00B01URT7800@mail-amer.sun.com> (original mail from Aarti.Pai@Sun.COM) ; Wed, 30 Jan 2008 10:20:34 -0700 (MST) Received: from [129.145.154.54] by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0JVG00H1JW51XN70@mail-amer.sun.com>; Wed, 30 Jan 2008 10:19:50 -0700 (MST) Date: Wed, 30 Jan 2008 09:19:49 -0800 From: Aarti Pai Subject: PSARC Materials for ZFS Encrypted Datasets (2007/261) In-reply-to: <479FE2D1.4020109@sun.com> Sender: Aarti.Pai@sun.com To: psarc@sun.com Cc: Jennifer Bauer , Garrett.Damore@sun.com, zfscrypto-core@sun.com Reply-to: Aarti.Pai@sun.com Message-id: <47A0B1B5.6020808@Sun.COM> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <479FE2D1.4020109@sun.com> User-Agent: Thunderbird 2.0.0.6 (X11/20070802) Status: RO Content-Length: 583 /shared/sac/Archives/CaseLog/arc/PSARC/2007/261/commitment.materials sac% ls -l total 1045 -rw-r--r-- 1 apai sac 3667 Jan 30 09:18 cli-examples.txt -rw-r--r-- 1 apai sac 167424 Jan 30 09:18 man.tar -rw-r--r-- 1 apai sac 160505 Jan 30 09:18 zfs-crypto-design.pdf Aarti Jennifer Bauer wrote: > Here are the materials for PSARC Case ZFS Encrypted Datasets (2007/261) > > Attached are the following > > - Manpages > - Design Doc > - cli-examples.txt > > > Please let me know if you have any questions. > > Thanks > Jennifer Bauer > ZFS-Crypto PM From sac-owner Thu Feb 7 10:40:39 2008 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m17Iecu7005139 for ; Thu, 7 Feb 2008 10:40:38 -0800 (PST) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m17IeaJm013527 for <@sunmail2sca.sfbay.sun.com:All-ARCs@sun.com>; Thu, 7 Feb 2008 18:40:37 GMT Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JVV00503T7OT800@brm-avmta-1.central.sun.com> for All-ARCs@sun.com (ORCPT All-ARCs@Sun.COM); Thu, 07 Feb 2008 11:40:36 -0700 (MST) Received: from brmea-mail-4.sun.com ([192.18.98.36]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JVV00EFNT7OZWD0@brm-avmta-1.central.sun.com> for All-ARCs@sun.com (ORCPT All-ARCs@Sun.COM); Thu, 07 Feb 2008 11:40:36 -0700 (MST) Received: from fe-amer-09.sun.com ([192.18.109.79]) by brmea-mail-4.sun.com (8.13.6+Sun/8.12.9) with ESMTP id m17Ieafj008016 for ; Thu, 07 Feb 2008 18:40:36 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0JVV00601SB7QN00@mail-amer.sun.com> (original mail from Aarti.Pai@Sun.COM) for All-ARCs@Sun.COM (ORCPT All-ARCs@Sun.COM); Thu, 07 Feb 2008 11:40:36 -0700 (MST) Received: from [129.145.154.90] by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0JVV003JGT7CUV70@mail-amer.sun.com> for All-ARCs@Sun.COM (ORCPT All-ARCs@Sun.COM); Thu, 07 Feb 2008 11:40:24 -0700 (MST) Date: Thu, 07 Feb 2008 10:40:24 -0800 From: Aarti Pai Subject: PSARC Case Approved 02/06/2008 (2007/261) Sender: Aarti.Pai@sun.com To: Aarti Pai Reply-to: Aarti.Pai@sun.com Message-id: <47AB5098.5030704@Sun.COM> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 User-Agent: Thunderbird 2.0.0.6 (X11/20070802) Status: RO Content-Length: 215 PSARC approved 02/06/2008 Case: ZFS Encrypted Datasets (2007/261) Incompatible Changes: none Precedent: none If more information is needed, please contact the case owner/intern. Aarti From sacadmin Thu Feb 7 14:24:04 2008 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m17MO4Ra015402 for ; Thu, 7 Feb 2008 14:24:04 -0800 (PST) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m17MO1fQ016316; Thu, 7 Feb 2008 14:24:02 -0800 (PST) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JVW00M0J3K0TQ00@brm-avmta-1.central.sun.com>; Thu, 07 Feb 2008 15:24:00 -0700 (MST) Received: from brmea-mail-2.sun.com ([192.18.98.43]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JVW00LEG3JZHI10@brm-avmta-1.central.sun.com>; Thu, 07 Feb 2008 15:23:59 -0700 (MST) Received: from fe-amer-10.sun.com ([192.18.109.80]) by brmea-mail-2.sun.com (8.13.6+Sun/8.12.9) with ESMTP id m17MNx1r003761; Thu, 07 Feb 2008 22:23:59 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0JVW00I011REM300@mail-amer.sun.com> (original mail from Aarti.Pai@Sun.COM) ; Thu, 07 Feb 2008 15:23:59 -0700 (MST) Received: from [129.145.154.90] by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0JVW00KGX3JMJK80@mail-amer.sun.com>; Thu, 07 Feb 2008 15:23:47 -0700 (MST) Date: Thu, 07 Feb 2008 14:23:46 -0800 From: Aarti Pai Subject: Meeting Minutes for PSARC - 02/06/2008 - (2007/261) , (2007/588) Sender: Aarti.Pai@sun.com To: psarc@sun.com Cc: Ted Pogue Jr , samqfs-psarc-interest@sun.com, John Fischer , Stefan Teleman , "Terry (Sarito) Whatley" , Randall Fishel , Phi Tran Reply-to: Aarti.Pai@sun.com Message-id: <47AB84F2.4030906@Sun.COM> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 User-Agent: Thunderbird 2.0.0.6 (X11/20070802) Status: RO Content-Length: 957 Minutes/Audio for PSARC 02/06/2008 are now available: - Closed Arc Business: http://sac.sfbay/Archives/Minutes/PSARC/2008/20080206.arcbiz.closed Closed Audio: http://sac.sfbay/Archives/Minutes/PSARC/2008/20080206.arcbiz.closed.mp3 - Open Arc Business: http://sac.sfbay/Archives/Minutes/PSARC/2008/20080206.arcbiz.open Open Audio: http://sac.sfbay/Archives/Minutes/PSARC/2008/20080206.arcbiz.open.mp3 - Open Commitment: ZFS Encrypted Datasets (2007/261) http://sac.sfbay/Archives/Minutes/PSARC/2008/20080206.2007.261.commitment Audio: http://sac.sfbay/Archives/Minutes/PSARC/2008/20080206.2007.261.commitment.mp3 - Open Inception: SAM-QFS 5.0 (2007/588) http://sac.sfbay/Archives/Minutes/PSARC/2008/20080206.2007.588.inception Audio: http://sac.sfbay/Archives/Minutes/PSARC/2008/20080206.2007.588.inception.mp3 Please contact me directly if you require any corrections/modifications to these minutes. Aarti From gdamore@sun.com Wed Feb 13 08:44:18 2008 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m1DGiIoi001230 for ; Wed, 13 Feb 2008 08:44:18 -0800 (PST) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m1DGiHSw001005 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Wed, 13 Feb 2008 08:44:17 -0800 (PST) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JW600E1ARTTCL00@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 13 Feb 2008 08:44:17 -0800 (PST) Received: from sca-es-mail-1.sun.com ([192.18.43.132]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JW600AMXRTRNS80@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 13 Feb 2008 08:44:15 -0800 (PST) Received: from fe-sfbay-09.sun.com ([192.18.43.129]) by sca-es-mail-1.sun.com (8.13.7+Sun/8.12.9) with ESMTP id m1DGiF3h015517 for ; Wed, 13 Feb 2008 08:44:15 -0800 (PST) Received: from conversion-daemon.fe-sfbay-09.sun.com by fe-sfbay-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0JW600L01RRHOQ00@fe-sfbay-09.sun.com> (original mail from gdamore@sun.com) for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 13 Feb 2008 08:44:15 -0800 (PST) Received: from [192.168.251.106] ([76.174.83.55]) by fe-sfbay-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0JW6006AWRTQZA60@fe-sfbay-09.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 13 Feb 2008 08:44:14 -0800 (PST) Date: Wed, 13 Feb 2008 08:42:58 -0800 From: "Garrett D'Amore" Subject: PSARC 2007/261 Opinion For Review by 02/20/2008 (ZFS Encrypted Datasets) Sender: Garrett.Damore@sun.com To: PSARC-ext@sun.com Message-id: <47B31E12.7020209@sun.com> MIME-version: 1.0 Content-type: multipart/mixed; boundary="Boundary_(ID_OekIhhD8dN5DOyXSK1UcKw)" X-PMX-Version: 5.2.0.264296 User-Agent: Thunderbird 2.0.0.6 (X11/20071023) Status: RO Content-Length: 5493 This is a multi-part message in MIME format. --Boundary_(ID_OekIhhD8dN5DOyXSK1UcKw) Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT Attached find the draft opinion. For your viewing pleasure, ASCII, PDF, and PostScript versions of the same are available in the case directory. (opinion-draft.{txt,pdf,ps}) - Garrett --Boundary_(ID_OekIhhD8dN5DOyXSK1UcKw) Content-type: text/plain; name=opinion-draft.txt Content-transfer-encoding: 7BIT Content-disposition: inline; filename=opinion-draft.txt sun microsystems Systems Architecture Committee _________________________________________________________________ Subject: ZFS Encrypted Datasets Submitted by: Darren Moffat File: PSARC/2007/261/opinion.ms Date: February 6, 2008 Committee: Darren Moffat (opinion written by Garrett D'Amore), Kais Belgaied, Mark Carlson, Joseph Kowalski, Glenn Skinner. Product Approval Committee: Solaris PAC solaris-pac-opinion@sun.com 1. Summary ZFS Encrypted Datasets is a project to provide cryptographic security to ZFS datasets. Specifically, it is intended to protect against theft of physical storage, man-in-the-middle attacks on the SAN, and to provide dataset level secured deletion. Data is encrypted at the data set level, allowing a mix of encrypted and unencrypted data in the same ZFS storage pool. The ZFS command-line and graphical user interfaces will be updated accordingly. 2. Decision & Precedence Information The project is approved as specified in reference [1]. The project may be delivered in a patch release of the ON consolidation. The project depends on the following other project and may not be delivered before it. PSARC/2007/266 AES CCM for kernel crypto framework 3. Interfaces PSARC/2007/261 Copyright 2008 Sun Microsystems - 2 - The project exports the following interfaces. _______________________________________________________________ | Interfaces Exported | |__________|________________|_________________________________| |Interface | Classification| Comments | |__________|________________|_________________________________| |encryption| Committed | Dataset property | |sha256+ccm| Committed | Dataset checksum property value| |keyscope | Committed | Dataset property | |keysource | Committed | Dataset/pool property | |keystatus | Committed | Dataset/pool property | |zfs key | Committed | ZFS dataset key command | |zpool key | Committed | ZFS pool key command | |__________|________________|_________________________________| The project imports the following interfaces. _________________________________________________________________________ | Interfaces Imported | |______________________________|_______________________|________________| |Interface | Classification | Comments | |______________________________|_______________________|________________| |Kernel Cryptographic subsystem| Consolidation Private| PSARC 2001/533| | | | | |______________________________|_______________________|________________| 4. Opinion 4.1. Encrypted swap. The project team noted that encryption of a dataset used for swap was possible, but suffers from several security limita- tions which prevent it from being fully secure. The project team recommended that a project be funded to investigate resolving these limitations, involving both the memory sub- system and the security teams. 4.2. Documentation of key compromise During discussion, it was noted that documentation covering policy and procedures for handling of various forms of key compromise was required. The project team indicated that it plans to update the System Administration guide to cover this, but one member noted that it would be desirable to include at least a reference to the guide in the zfs and/or zpool manual pages. 5. Minority Opinion(s) None. PSARC/2007/261 Copyright 2008 Sun Microsystems - 3 - 6. Advisory Information A project to investigate properly securing swap using cryp- tography should be funded, involving both the security and virtual memory teams. 7. Appendices 7.1. Appendix A: Technical Changes Required None. 7.2. Appendix B: Technical Changes Advised None. 7.3. Appendix C: Reference Material Unless stated otherwise, path names are relative to the case directory PSARC/2007/261. 1. One pager File: 20070509_darren.moffat 2. Design document File: commitment.materials/zfs-crypto-design.pdf 3. Updated zfs manual page File: commitment.materials/zfs.1m 4. Updated zpool manual page File: commitment.materials/zpool.1m 5. Command line examples File: commitment.materials/cli-examples.txt 6. Notes from commitment review File: 20080206.2007.261.commitment 7. OpenSolaris Project web page URL: http://opensolaris.org/os/project/zfs-crypto/ PSARC/2007/261 Copyright 2008 Sun Microsystems --Boundary_(ID_OekIhhD8dN5DOyXSK1UcKw)--