DOCSLIB.ORG

End-To-End Encryption of Data at Rest for Linux on Z and Linuxone

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
End-To-End Encryption of Data at Rest for Linux on Z and Linuxone End-to-end Encryption of Data at Rest for Linux on Z and LinuxONE Ingo Franzki [email protected] Reinhard Buendgen [email protected] VM Workshop 2019 © Copyright IBM Corporation 2019 Data Protection and Security are Business Imperatives Nearly 6,5 million “It’s no longer records stolen per day, 24% 267,905 per hour a matter of if, Likelihood of an organization having a data breach in the next but when …” and per minute. 1 4,465 24 months 2 The greatest security mistake organizations Of the 14 Billion records make is failing to protect their networks and data from internal threats . 3 breached since 2013 only 4% were encrypted 4 1 http://breachlevelindex.com/ 2 2016 Ponemon Cost of Data Breach Study: Global Analysis -- http://www.ibm.com/security/data-breach/ 3 Steve Marsh in article: https://digitalguardian.com/blog/expert-guide-securing-sensitive-data-34-experts-reveal-biggest-mistakes-companies-make-data 4 Breach Level Index -- http://breachlevelindex.com/ 2 VM Workshop 2019 The Value of Data … — Today data is one of the most valuable assets of many companies — In particular sensitive data must be protected against unauthorized access to avoid • Losing customer trust • Losing competitive advantages • Being subject to fines and regression claims — Data encryption is the most effective way to protect data outside your system be it in flight or at rest — But encrypting data is not easy • Requires the introduction of new policies • Complicates data management • Requires to securely manage keys • Costs computing resources VM Workshop 2019 3 © Copyright IBM Corporation 2019 Attacks Online attack Offline attack — Steal or modify data from inside your system — Steal or modify data from outside your system — Requires system access with required privileges • The data might even be a dump of your system at a service organization — Attack is observable — Requires access to network, SAN, media • Takes time proportional to the amount of data • May but need not involve stealing media that is attacked • May require access to an decryption key • Has impact on the operation of attacked system (costs resources) — Attack is hard to observe if it is observable at • It is hard not to leave traces all • Neither time nor resource constrained VM Workshop 2019 © Copyright IBM Corporation 2019 Protecting data against offline attacks How can you control access outside your Solution: system? — Data transferred via intranet or internet You better encrypt that data! — Data transferred via SAN — Data stored in storage subsystems Do you trust access control mechanisms of network/SAN/storage subsystems? — Is there any effective access control? — Do you own access control? VM Workshop 2019 © Copyright IBM Corporation 2019 Cryptography Can Cannot — Prove data provenance — Protect you from your keys getting stolen — Prove data integrity — Protect data confidentiality • by an insider • by an intruder • via a vulnerability — Kerkhoff’s Principle for secure cryptography: • All cryptography methods should be well known • Only the cryptographic keys must be secret When you protect your data using cryptography you must protect your keys! They are the most critical piece of data! VM Workshop 2019 © Copyright IBM Corporation 2019 Here is a Dream … What if you could just encrypt all data in-flight and at-rest — At no cost — Without changing applications — Without changing data management — By pushing a single button Well, that will remain to be a dream But with pervasive encryption we want to make a large step in that direction VM Workshop 2019 7 © Copyright IBM Corporation 2019 Pervasive Encryption for the Linux on Z and LinuxONE Platform Technical Foundation IBM z14 or Emporer II - Designed for Pervasive Encryption — CPACF – Dramatic advance in bulk symmetric encryption performance — Crypto Express6S – Doubling of asymmetric encryption performance for TLS handshakes Linux on Z and LinuxONE - Full Power of Linux Ecosystem combined with IBM z14 or Emporer II Capabilities — dm-crypt – Transparent volume encryption using industry unique CPACF protected-keys — Network Security – Enterprise scale encryption and handshakes using CPACF and SIMD — Secure Service Container – Automatic protection of data and code for virtual appliances z/VM – New: encrypted paging • z/VM 6.4 APAR VM65993 VM Workshop 2019 8 © Copyright IBM Corporation 2019 Pervasive Encryption for Linux on Z and LinuxONE Technical Contents: Data at Rest VM Workshop 2019 9 © Copyright IBM Corporation 2019 Data at Rest Encryption Considerations Online attacks Offline attacks Storage server Server Virtual Server Application OS-kernel Cache SAN Hypervisor Adapter Adapter Attack points Questions — Storage server — Where is data decrypted/encrypted? — SAN — Who generates keys? — Server / Hypervisor / Virtual Server — Who owns (can access) the keys? • Insider / outsider — Backups? Data migration? VM Workshop 2019 10 © Copyright IBM Corporation 2019 Data Encryption on Storage Subsystem Storage server Server Virtual Server Application OS-kernel Cache SAN Hypervisor Adapter Adapter Attack points Questions — Storage server – (Secured) — Where is data decrypted/encrypted? — SAN – Not secure — Who generates keys? Storage/OS — Server / Hypervisor – Not secure — Who owns (can access) the keys? Storage/OS — Virtual Server insider / outsider – Not secure admin VM Workshop 2019 11 © Copyright IBM Corporation 2019 End-to-End SAN/Network Encryption Storage server Server Virtual Server Application OS-kernel Cache SAN Hypervisor Adapteradapter Adapter Attack points Questions — Storage server – Not secure — Where is data decrypted/encrypted? Adapter — SAN – Secured — Who generates keys? System admin — Server / Hypervisor – Not secure — Who owns (can access) the keys? System admins — Virtual Server insider / outsider – Not secure VM Workshop 2019 12 © Copyright IBM Corporation 2019 End-to-End Data Encryption Storage server Server Virtual Server Application OS-kernel Cache SAN Hypervisor Adapteradapter Adapter Attack points Questions — Storage server – Secured — Where is data decrypted/encrypted? Application or — SAN – Secured kernel — Server / Hypervisor – Secured — Who generates keys? Application or OS admin — Virtual Server insider / outsider – Not secure — Who owns (can access) the keys? Application or OS admin VM Workshop 2019 13 © Copyright IBM Corporation 2019 Linux on Z Encryption of Data at Rest — dm-crypt: block device / full volume encryption • Uses kernel crypto Kernel crypto • Granularity: disk partition / logical volume automatically uses — ext4 with encryption option: file system encryption CPACF for AES if the • Uses kernel crypto module aes_s390 is • Granularity: file, directory, symbolic link loaded — Spectrum Scale (GPFS) with encryption option: file encryption • Uses GSKit or Clic crypto libraries GSKit and latest • Granularity: file versions of Clic use End-to-End Encryption End-to-End — DB2 native encryption: data base encryption CPACF for AES • Uses GSKit crypto library — NFS v4 with encryption option: encryption of file transport • Uses kernel crypto — SMB v3.1: encryption of file transport Network • Uses kernel crypto Encryption VM Workshop 2019 14 © Copyright IBM Corporation 2019 dm-crypt & LUKS VM Workshop 2019 15 © Copyright IBM Corporation 2019 dm-crypt Overview — dm-crypt • A mechanism for end-to-end data encryption Linux • Data only appears in the clear when in program application — Kernel component that transparently • For a whole block device (partition or LVM Logical Volume) file system o Encrypts all data written to disk o Decrypts all data read from disk dm-cryptFS block device driver — How it works: Linux kernel • On opening a volume o dm crypt is told which key and cipher to use SAN • dm-crypt module uses in kernel-crypto On IBM z14 o can use IBM Z HW if aes_s390 module loaded or Emporer II XTS-AES is > AES-CBC vey fast disk > XTS-AES (recommended) vdisk VM Workshop 2019 16 © Copyright IBM Corporation 2019 Linux File System Stack Application Direct I/O I/O system call (bypassing (open, read, Virtual file system page cache) write) File system (e.g. ext4) Page cache Direct I/O Standard I/O to device (through page cache) (e.g. swap) Logical block DD Layers of logical Logical block DD device drivers: logical volumes, Physical Physical block DD RAID, multipath block DD Kernel Disk Disk VM Workshop 2019 17 © Copyright IBM Corporation 2019 Linux File System Stack with dm-crypt Application Direct I/O I/O system call (bypassing (open, read, Virtual file system page cache) write) File system (e.g. ext4) Page cache Direct I/O Standard I/O Clear text Clear to device (through page cache) (e.g. swap) Logical block DD dm-crypt Layers of logical Logical block DD device drivers: logical volumes, Physical Physical block DD RAID, multipath block DD Kernel + dm-crypt Encrypted Disk Disk VM Workshop 2019 18 © Copyright IBM Corporation 2019 What Volumes can be Encrypted by dm-crypt? YES: block devices NO: — Disks: — Full ECKD DASDs • SCSI disks — Network file systems like NFS — Partitions of • However, you can create a loopback device • ECKD DASDs based on a file in a network file system • SCSI disks — Muti-path devices — (LVM2) Logical volumes — Loop back devices — Other device mapper devices VM Workshop 2019 19 © Copyright IBM Corporation 2019 dm-crypt & cryptsetup - Volume Formats dm-crypt cryptsetup — Kernel module — Tool to manage encrypted volumes — Supports multiple volume formats (aka types) • Formats volumes o LUKS & LUKS2 types • plain Focus • LUKS • Opens volumes • LUKS2 Focus o plain, LUKS, LUKS2,
Load more

Recommended publications
  • Red Hat Enterprise Linux 7 7.1 Release Notes
    Red Hat Enterprise Linux 7 7.1 Release Notes Release Notes for Red Hat Enterprise Linux 7 Red Hat Customer Content Services Red Hat Enterprise Linux 7 7.1 Release Notes Release Notes for Red Hat Enterprise Linux 7 Red Hat Customer Content Services Legal Notice Copyright © 2015 Red Hat, Inc. This document is licensed by Red Hat under the Creative Commons Attribution-ShareAlike 3.0 Unported License. If you distribute this document, or a modified version of it, you must provide attribution to Red Hat, Inc. and provide a link to the original. If the document is modified, all Red Hat trademarks must be removed. Red Hat, as the licensor of this document, waives the right to enforce, and agrees not to assert, Section 4d of CC-BY-SA to the fullest extent permitted by applicable law. Red Hat, Red Hat Enterprise Linux, the Shadowman logo, JBoss, MetaMatrix, Fedora, the Infinity Logo, and RHCE are trademarks of Red Hat, Inc., registered in the United States and other countries. Linux ® is the registered trademark of Linus Torvalds in the United States and other countries. Java ® is a registered trademark of Oracle and/or its affiliates. XFS ® is a trademark of Silicon Graphics International Corp. or its subsidiaries in the United States and/or other countries. MySQL ® is a registered trademark of MySQL AB in the United States, the European Union and other countries. Node.js ® is an official trademark of Joyent. Red Hat Software Collections is not formally related to or endorsed by the official Joyent Node.js open source or commercial project.
    [Show full text]
  • Operating System Boot from Fully Encrypted Device
    Masaryk University Faculty of Informatics Operating system boot from fully encrypted device Bachelor’s Thesis Daniel Chromik Brno, Fall 2016 Replace this page with a copy of the official signed thesis assignment and the copy of the Statement of an Author. Declaration Hereby I declare that this paper is my original authorial work, which I have worked out by my own. All sources, references and literature used or excerpted during elaboration of this work are properly cited and listed in complete reference to the due source. Daniel Chromik Advisor: ing. Milan Brož i Acknowledgement I would like to thank my advisor, Ing. Milan Brož, for his guidance and his patience of a saint. Another round of thanks I would like to send towards my family and friends for their support. ii Abstract The goal of this work is description of existing solutions for boot- ing Linux and Windows from fully encrypted devices with Secure Boot. Before that, though, early boot process and bootloaders are de- scribed. A simple Linux distribution is then set up to boot from a fully encrypted device. And lastly, existing Windows encryption solutions are described. iii Keywords boot process, Linux, Windows, disk encryption, GRUB 2, LUKS iv Contents 1 Introduction ............................1 1.1 Thesis goals ..........................1 1.2 Thesis structure ........................2 2 Boot Process Description ....................3 2.1 Early Boot Process ......................3 2.2 Firmware interfaces ......................4 2.2.1 BIOS – Basic Input/Output System . .4 2.2.2 UEFI – Unified Extended Firmware Interface .5 2.3 Partitioning tables ......................5 2.3.1 MBR – Master Boot Record .
    [Show full text]
  • The Linux Kernel Module Programming Guide
    The Linux Kernel Module Programming Guide Peter Jay Salzman Michael Burian Ori Pomerantz Copyright © 2001 Peter Jay Salzman 2007−05−18 ver 2.6.4 The Linux Kernel Module Programming Guide is a free book; you may reproduce and/or modify it under the terms of the Open Software License, version 1.1. You can obtain a copy of this license at http://opensource.org/licenses/osl.php. This book is distributed in the hope it will be useful, but without any warranty, without even the implied warranty of merchantability or fitness for a particular purpose. The author encourages wide distribution of this book for personal or commercial use, provided the above copyright notice remains intact and the method adheres to the provisions of the Open Software License. In summary, you may copy and distribute this book free of charge or for a profit. No explicit permission is required from the author for reproduction of this book in any medium, physical or electronic. Derivative works and translations of this document must be placed under the Open Software License, and the original copyright notice must remain intact. If you have contributed new material to this book, you must make the material and source code available for your revisions. Please make revisions and updates available directly to the document maintainer, Peter Jay Salzman <[email protected]>. This will allow for the merging of updates and provide consistent revisions to the Linux community. If you publish or distribute this book commercially, donations, royalties, and/or printed copies are greatly appreciated by the author and the Linux Documentation Project (LDP).
    [Show full text]
  • Studying the Real World Today's Topics
    Studying the real world Today's topics Free and open source software (FOSS) What is it, who uses it, history Making the most of other people's software Learning from, using, and contributing Learning about your own system Using tools to understand software without source Free and open source software Access to source code Free = freedom to use, modify, copy Some potential benefits Can build for different platforms and needs Development driven by community Different perspectives and ideas More people looking at the code for bugs/security issues Structure Volunteers, sponsored by companies Generally anyone can propose ideas and submit code Different structures in charge of what features/code gets in Free and open source software Tons of FOSS out there Nearly everything on myth Desktop applications (Firefox, Chromium, LibreOffice) Programming tools (compilers, libraries, IDEs) Servers (Apache web server, MySQL) Many companies contribute to FOSS Android core Apple Darwin Microsoft .NET A brief history of FOSS 1960s: Software distributed with hardware Source included, users could fix bugs 1970s: Start of software licensing 1974: Software is copyrightable 1975: First license for UNIX sold 1980s: Popularity of closed-source software Software valued independent of hardware Richard Stallman Started the free software movement (1983) The GNU project GNU = GNU's Not Unix An operating system with unix-like interface GNU General Public License Free software: users have access to source, can modify and redistribute Must share modifications under same
    [Show full text]
  • Android (Operating System) 1 Android (Operating System)
    Android (operating system) 1 Android (operating system) Android Home screen displayed by Samsung Nexus S with Google running Android 2.3 "Gingerbread" Company / developer Google Inc., Open Handset Alliance [1] Programmed in C (core), C++ (some third-party libraries), Java (UI) Working state Current [2] Source model Free and open source software (3.0 is currently in closed development) Initial release 21 October 2008 Latest stable release Tablets: [3] 3.0.1 (Honeycomb) Phones: [3] 2.3.3 (Gingerbread) / 24 February 2011 [4] Supported platforms ARM, MIPS, Power, x86 Kernel type Monolithic, modified Linux kernel Default user interface Graphical [5] License Apache 2.0, Linux kernel patches are under GPL v2 Official website [www.android.com www.android.com] Android is a software stack for mobile devices that includes an operating system, middleware and key applications.[6] [7] Google Inc. purchased the initial developer of the software, Android Inc., in 2005.[8] Android's mobile operating system is based on a modified version of the Linux kernel. Google and other members of the Open Handset Alliance collaborated on Android's development and release.[9] [10] The Android Open Source Project (AOSP) is tasked with the maintenance and further development of Android.[11] The Android operating system is the world's best-selling Smartphone platform.[12] [13] Android has a large community of developers writing applications ("apps") that extend the functionality of the devices. There are currently over 150,000 apps available for Android.[14] [15] Android Market is the online app store run by Google, though apps can also be downloaded from third-party sites.
    [Show full text]
  • Flexible Lustre Management
    Flexible Lustre management Making less work for Admins ORNL is managed by UT-Battelle for the US Department of Energy How do we know Lustre condition today • Polling proc / sysfs files – The knocking on the door model – Parse stats, rpc info, etc for performance deviations. • Constant collection of debug logs – Heavy parsing for common problems. • The death of a node – Have to examine kdumps and /or lustre dump Origins of a new approach • Requirements for Linux kernel integration. – No more proc usage – Migration to sysfs and debugfs – Used to configure your file system. – Started in lustre 2.9 and still on going. • Two ways to configure your file system. – On MGS server run lctl conf_param … • Directly accessed proc seq_files. – On MSG server run lctl set_param –P • Originally used an upcall to lctl for configuration • Introduced in Lustre 2.4 but was broken until lustre 2.12 (LU-7004) – Configuring file system works transparently before and after sysfs migration. Changes introduced with sysfs / debugfs migration • sysfs has a one item per file rule. • Complex proc files moved to debugfs • Moving to debugfs introduced permission problems – Only debugging files should be their. – Both debugfs and procfs have scaling issues. • Moving to sysfs introduced the ability to send uevents – Item of most interest from LUG 2018 Linux Lustre client talk. – Both lctl conf_param and lctl set_param –P use this approach • lctl conf_param can set sysfs attributes without uevents. See class_modify_config() – We get life cycle events for free – udev is now involved. What do we get by using udev ? • Under the hood – uevents are collect by systemd and then processed by udev rules – /etc/udev/rules.d/99-lustre.rules – SUBSYSTEM=="lustre", ACTION=="change", ENV{PARAM}=="?*", RUN+="/usr/sbin/lctl set_param '$env{PARAM}=$env{SETTING}’” • You can create your own udev rule – http://reactivated.net/writing_udev_rules.html – /lib/udev/rules.d/* for examples – Add udev_log="debug” to /etc/udev.conf if you have problems • Using systemd for long task.
    [Show full text]
  • Version 7.8-Systemd
    Linux From Scratch Version 7.8-systemd Created by Gerard Beekmans Edited by Douglas R. Reno Linux From Scratch: Version 7.8-systemd by Created by Gerard Beekmans and Edited by Douglas R. Reno Copyright © 1999-2015 Gerard Beekmans Copyright © 1999-2015, Gerard Beekmans All rights reserved. This book is licensed under a Creative Commons License. Computer instructions may be extracted from the book under the MIT License. Linux® is a registered trademark of Linus Torvalds. Linux From Scratch - Version 7.8-systemd Table of Contents Preface .......................................................................................................................................................................... vii i. Foreword ............................................................................................................................................................. vii ii. Audience ............................................................................................................................................................ vii iii. LFS Target Architectures ................................................................................................................................ viii iv. LFS and Standards ............................................................................................................................................ ix v. Rationale for Packages in the Book .................................................................................................................... x vi. Prerequisites
    [Show full text]
  • Self-Encrypting Deception: Weaknesses in the Encryption of Solid State Drives
    Self-encrypting deception: weaknesses in the encryption of solid state drives Carlo Meijer Bernard van Gastel Institute for Computing and Information Sciences School of Computer Science Radboud University Nijmegen Open University of the Netherlands [email protected] and Institute for Computing and Information Sciences Radboud University Nijmegen Bernard.vanGastel@{ou.nl,ru.nl} Abstract—We have analyzed the hardware full-disk encryption full-disk encryption. Full-disk encryption software, especially of several solid state drives (SSDs) by reverse engineering their those integrated in modern operating systems, may decide to firmware. These drives were produced by three manufacturers rely solely on hardware encryption in case it detects support between 2014 and 2018, and are both internal models using the SATA and NVMe interfaces (in a M.2 or 2.5" traditional form by the storage device. In case the decision is made to rely on factor) and external models using the USB interface. hardware encryption, typically software encryption is disabled. In theory, the security guarantees offered by hardware encryp- As a primary example, BitLocker, the full-disk encryption tion are similar to or better than software implementations. In software built into Microsoft Windows, switches off software reality, we found that many models using hardware encryption encryption and completely relies on hardware encryption by have critical security weaknesses due to specification, design, and implementation issues. For many models, these security default if the drive advertises support. weaknesses allow for complete recovery of the data without Contribution. This paper evaluates both internal and external knowledge of any secret (such as the password).
    [Show full text]
  • Zenworks 2017 Update 4 Troubleshooting Full Disk Encryption January 2019
    ZENworks 2017 Update 4 Troubleshooting Full Disk Encryption January 2019 This document provides troubleshooting guidelines for common problems related to ZENworks Full Disk Encryption. If, after completing the troubleshooting steps, the problem is not resolved, you should contact Technical Support (https://www.novell.com/support/) for additional help. 1 Windows PE Emergency Recovery Disk (ERD) is not working Make sure you have installed the correct WAIK architecture (32-bit vs 64-bit) (Windows 7 only) If you manually created the ERD, use the PowerShell script provided in the Cool Solutions “Windows Powershell script to create a Windows PE emergency recovery disk for ZENworks Full Disk Encryption” article. Try creating the ERD using the ADK for Windows instead of Windows AIK. See “Creating a Windows PE Emergency Recovery Disk” in the ZENworks Full Disk Encryption Emergency Recovery Reference. Try burning the ERD to a DVD rather than a CD. 2 Issues with PBA login or boot sequence After pre-boot authentication occurs, the BIOS or UEFI settings must be correctly set for Windows. With unusual DMI hardware configurations, the standard ZENworks PBA boot method and Linux kernel configuration used to provide the BIOS settings, might not work, resulting in hardware that does not function correctly or is not recognized by Windows. Beginning in ZENworks 2017 Update 2, the Full Disk Encryption Agent includes DMI menu options to repair the boot sequence for issues relating to these DMI configurations. This menu is accessible by using the Ctrl + G keyboard command at a brief point when Full Disk Encryption is shown during a device restart.
    [Show full text]
  • [13주차] Sysfs and Procfs
    1 7 Computer Core Practice1: Operating System Week13. sysfs and procfs Jhuyeong Jhin and Injung Hwang Embedded Software Lab. Embedded Software Lab. 2 sysfs 7 • A pseudo file system provided by the Linux kernel. • sysfs exports information about various kernel subsystems, HW devices, and associated device drivers to user space through virtual files. • The mount point of sysfs is usually /sys. • sysfs abstrains devices or kernel subsystems as a kobject. Embedded Software Lab. 3 How to create a file in /sys 7 1. Create and add kobject to the sysfs 2. Declare a variable and struct kobj_attribute – When you declare the kobj_attribute, you should implement the functions “show” and “store” for reading and writing from/to the variable. – One variable is one attribute 3. Create a directory in the sysfs – The directory have attributes as files • When the creation of the directory is completed, the directory and files(attributes) appear in /sys. • Reference: ${KERNEL_SRC_DIR}/include/linux/sysfs.h ${KERNEL_SRC_DIR}/fs/sysfs/* • Example : ${KERNEL_SRC_DIR}/kernel/ksysfs.c Embedded Software Lab. 4 procfs 7 • A special filesystem in Unix-like operating systems. • procfs presents information about processes and other system information in a hierarchical file-like structure. • Typically, it is mapped to a mount point named /proc at boot time. • procfs acts as an interface to internal data structures in the kernel. The process IDs of all processes in the system • Kernel provides a set of functions which are designed to make the operations for the file in /proc : “seq_file interface”. – We will create a file in procfs and print some data from data structure by using this interface.
    [Show full text]
  • Disk Encryption with 100Gbe Crypto Accelerator
    Disk Encryption with 100GbE Crypto Accelerator Chelsio T6 vs. Intel AES-NI vs. Software Enabled Encryption Executive Summary Chelsio Crypto Accelerator is a co-processor designed specifically to perform computationally intensive cryptographic operations more efficiently than general-purpose CPUs. Servers with system load, comprising of cryptographic operations, see great performance improvement by offloading crypto operations on to the Chelsio Unified Wire adapter. Chelsio’s solution uses the standard crypto API framework provided by the operating system and enables the offloading of crypto operations to the adapter. This paper showcases the disk encryption acceleration capabilities of Chelsio T6 adapters by comparing its performance with Intel AES-NI and software encryption. Chelsio solution excels with 100Gbps Crypto rate performance for both encryption and decryption with less than 50% CPU usage. Chelsio’s T6 encryption solution assures complete data protection to datacenters, while providing substantial savings on CPU and memory. Chelsio Disk Encryption Offload The Terminator 6 (T6) ASIC from Chelsio Communications, Inc. is a sixth generation, high performance 1/10/25/40/50/100Gbps unified wire engine which offers crypto offload capability for AES and SHA variants. Chelsio’s disk encryption solution is a special case of data at rest protection where the storage media is a sector-addressable device. Chelsio offloads the AES-XTS mode, which is designed for encrypting data stored on hard disks where there is no additional space for an integrity field. AES-XTS builds on the security of AES by protecting the storage device from many dictionary and copy/paste attacks. Chelsio crypto driver registers with the kernel crypto framework with high priority and ensures that any disk encryption request is offloaded and processed by T6 adapter.
    [Show full text]
  • Speeding up Linux Disk Encryption Ignat Korchagin @Ignatkn $ Whoami
    Speeding Up Linux Disk Encryption Ignat Korchagin @ignatkn $ whoami ● Performance and security at Cloudflare ● Passionate about security and crypto ● Enjoy low level programming @ignatkn Encrypting data at rest The storage stack applications @ignatkn The storage stack applications filesystems @ignatkn The storage stack applications filesystems block subsystem @ignatkn The storage stack applications filesystems block subsystem storage hardware @ignatkn Encryption at rest layers applications filesystems block subsystem SED, OPAL storage hardware @ignatkn Encryption at rest layers applications filesystems LUKS/dm-crypt, BitLocker, FileVault block subsystem SED, OPAL storage hardware @ignatkn Encryption at rest layers applications ecryptfs, ext4 encryption or fscrypt filesystems LUKS/dm-crypt, BitLocker, FileVault block subsystem SED, OPAL storage hardware @ignatkn Encryption at rest layers DBMS, PGP, OpenSSL, Themis applications ecryptfs, ext4 encryption or fscrypt filesystems LUKS/dm-crypt, BitLocker, FileVault block subsystem SED, OPAL storage hardware @ignatkn Storage hardware encryption Pros: ● it’s there ● little configuration needed ● fully transparent to applications ● usually faster than other layers @ignatkn Storage hardware encryption Pros: ● it’s there ● little configuration needed ● fully transparent to applications ● usually faster than other layers Cons: ● no visibility into the implementation ● no auditability ● sometimes poor security https://support.microsoft.com/en-us/help/4516071/windows-10-update-kb4516071 @ignatkn Block
    [Show full text]