zfs crypto discuss - Apr 2008 - [Bug 1052] New: ''zfs create -o encryption=aes-128-ccm -o keyscope=dataset . .'' failed

http://defect.opensolaris.org/bz/show_bug.cgi?id=1052

           Summary: ''zfs create -o encryption=aes-128-ccm -o
                    keyscope=dataset ..'' failed
    Classification: Development
           Product: zfs-crypto
           Version: unspecified
          Platform: Other
        OS/Version: Solaris
            Status: NEW
          Severity: critical
          Priority: P2
         Component: other
        AssignedTo: darrenm at opensolaris.org
        ReportedBy: hua.tang at sun.com
         QAContact: hua.tang at sun.com
                CC: zfs-crypto-discuss at opensolaris.org
   Estimated Hours: 0.0


Build: 2008-04-03

# zpool create tank /var/tmp/zfs-crypto/vdev_file
# zfs create -o encryption=aes-128-ccm -o keyscope=dataset -o
keysource=raw,file:///export/home/zfscrypto-tests/proto/suites/security/zfs-crypto/etc/raw_key_file
tank/fs
# echo $?
1
# zfs list
NAME   USED  AVAIL  REFER  MOUNTPOINT
tank   105K   984M    18K  /tank
#

No error messages were displayed. Return code is 1 and the dataset
isn''t
actually created.

There isn''t the problem with encryption=on and aes-256-ccm.

-- 
Configure bugmail: http://defect.opensolaris.org/bz/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

http://defect.opensolaris.org/bz/show_bug.cgi?id=1052


ajscarp at yahoo.com changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ACCEPTED




--- Comment #1 from ajscarp at yahoo.com  2008-04-08 23:53:40 ---
with the latest bits I have on my system, I cannot reproduce this, but I do not
doubt it existed.. I recently changed in zfs_create() to call zfs_error() on
failure of zfs_crypto_create()..  Without zfs_error() the error message would
get lost..

When the next build is available, I will verify there is no failure and change
this to fixed..

-- 
Configure bugmail: http://defect.opensolaris.org/bz/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

http://defect.opensolaris.org/bz/show_bug.cgi?id=1052


Darren J Moffat <darrenm at opensolaris.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ACCEPTED                    |CLOSED
         Resolution|                            |WORKSFORME




-- 
Configure bugmail: http://defect.opensolaris.org/bz/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

http://defect.opensolaris.org/bz/show_bug.cgi?id=1052


Grace <hua.tang at sun.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|CLOSED                      |REOPENED
         Resolution|WORKSFORME                  |




--- Comment #2 from Grace <hua.tang at sun.com>  2008-05-07 23:35:35 ---
Verified in the latest builds 2008-05-07 on amd64. It wasn''t fixed.

# zfs create -o encryption=aes-128-ccm -o keyscope=dataset -o
keysource=raw,file:///export/home/zfscrypto-tests/src/suites/security/zfs-crypto/etc/raw_key_file
test/fs
cannot create ''test/fs'': Key length invalid (32).

-- 
Configure bugmail: http://defect.opensolaris.org/bz/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

http://defect.opensolaris.org/bz/show_bug.cgi?id=1052





--- Comment #3 from Grace <hua.tang at sun.com>  2008-05-07 23:36:26 ---
Test case zfs_create_001 fails.

-- 
Configure bugmail: http://defect.opensolaris.org/bz/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

I don''t believe this is a failure.. The encryption algorithm, 
aes-128-ccm, requires a 16 byte key.  The error message says the length 
is invalid and it''s 32 byte long.  I would expect this to fail..

bugzilla-daemon at defect.opensolaris.org wrote:
> http://defect.opensolaris.org/bz/show_bug.cgi?id=1052
> 
> 
> Grace <hua.tang at sun.com> changed:
> 
>            What    |Removed                     |Added
>
----------------------------------------------------------------------------
>              Status|CLOSED                      |REOPENED
>          Resolution|WORKSFORME                  |
> 
> 
> 
> 
> --- Comment #2 from Grace <hua.tang at sun.com>  2008-05-07 23:35:35
---
> Verified in the latest builds 2008-05-07 on amd64. It wasn''t
fixed.
> 
> # zfs create -o encryption=aes-128-ccm -o keyscope=dataset -o
>
keysource=raw,file:///export/home/zfscrypto-tests/src/suites/security/zfs-crypto/etc/raw_key_file
> test/fs
> cannot create ''test/fs'': Key length invalid (32).
>

http://defect.opensolaris.org/bz/show_bug.cgi?id=1052


Darren J Moffat <darrenm at opensolaris.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|REOPENED                    |CLOSED
         Resolution|                            |INVALID




--- Comment #4 from Darren J Moffat <darrenm at opensolaris.org> 
2008-05-08 00:15:16 ---
This isn''t a bug but correct behaviour.

The error message is saying that the length of the file is 32 bytes but
aes-128-ccm was requested.  For aes-128-ccm the length of the raw key file
should be 16 bytes.  For aes-256-ccm the key file length should be 32 bytes.

-- 
Configure bugmail: http://defect.opensolaris.org/bz/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.