RFC: backporting GEOM to the 4.x branch

[Maxim Sobolev]

Roland Dowdeswell wrote:
[ cc'ing tech-security at xxxxxxxxxx, because there has been talk
  of GBDE there in the past.]
Well, I thought that since I saw this:

ALeine wrote a while ago:

df at xxxxxx wrote:

Wouldn't be easier porting cgd* from NetBSD ?

* http://www.netbsd.org/guide/en/chap-cgd.html
Perhaps, but I believe GBDE to be superior to CGD for a number
of reasons, one of the most important being that with GBDE you
can change the passphrase without re-encrypting the entire disk,
which is not the case with CGD, AFAIK. From Poul-Henning Kamp's
paper on GBDE:


That, as the author of CGD, I should respond to some common
misconceptions about my work which seem to be percolating around.
First, on the capability front, you can:

	1.  change the passphrase on a disk without re-encrypting it,
	2.  have as many passphrases as you would like to configure,
	3.  use n-factor authentication with arbitrary large n.
Also, GBDE has a number of serious drawbacks.  All of which would
be show-stoppers if I were considering using it for serious security
work, or even use in a production environment.
There is no protection _at_all_ against dictionary attacks.  Where
CGD uses PKCS#5 in a completely standard way to frustrate dictionary
attacks, GBDE does exactly nothing.  In fact, worse than nothing.
It is possible to conduct half of the dictionary attack offline,
so the actual online portion of the attack is something that my
laptop could make about 2^30 guesses in a couple of hours.  So, it
is insecure from the start.
Well, I think that this is quite minor item, since GBDE doesn't govern 
transformation of the passphrase into the actual key, so that another 
scheme more bullet-prof against dictionary attacks (PKCS#5 or any other) 
can be developed in virtually no time at all and will require making 
only minor changes to the userland utility which gets password from the 
keyboard or command line, hashes it and feeds to the kernel.

GBDE has no facility for using different encryption algorithms than
the rather...  interesting one that it comes with.  There is no
way to trade speed and security for different use cases, and the
only algorithm that it comes with is very slow.  Less than half
the performance of CGD's most secure algorithm (AES256).
Well, it's hard to comment on this, since the only paper that I have 
found on CGD is http://www.imrryr.org/~elric/cgd/cgd.pdf, which 
unfortunately doesn't provide any details on how CGD encrypts data and 
lays it out on disk.

So, now that we've touched on the security problems...  Let's think
about using GBDE in production.  Please reference
	http://phk.freebsd.dk/pubs/bsdcon-03.gbde.paper.pdf

And read Section 7.5, and refer to figure 2.

Each disk write involves two writes to the disk.  Where is the
journal?  I do not see any talk about a journal in the paper, or
the GBDE source code.  Hence, if the OS crashes or if a removable
disk is removed at the wrong time, etc. etc. it is possible that
only one of those writes would succeed.  I think that we can all
see where this is going.
So what? If the write fails in the middle, reading sector will just 
produce garbage. I don't think that it's different from plain old HDD 
which has been powered down in the middle of doing disk write. Disk 
encryption layer is definitely not the level at which journaling should 
be implemented. It's task of file system to do this. The task of 
encryption layer is merely to inform the file system when transaction 
(i.e. both of those two writes in this case) have been completed 
successfully, so that FS can adjust its journal accordingly.

-Maxim