zfs crypto discuss - Apr 2010 - Which builds of OpenSolaris has ZFS encryption included?

Hi,

Is there any OpenSolaris build with ZFS encryption support included out of
the box? If not, is there any repository and a compatible openSolaris build
to install the zfs crypto from that repostiory?

thanks
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://mail.opensolaris.org/pipermail/zfs-crypto-discuss/attachments/20100427/f6fb46bd/attachment.html>

Hi,

Is there any OpenSolaris build with ZFS encryption support included out of
the box? If not, is there any repository and a compatible openSolaris build
to install the zfs crypto from that repostiory?

thanks
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://mail.opensolaris.org/pipermail/zfs-crypto-discuss/attachments/20100427/f2ea44c6/attachment.html>

On 27/04/10 09:05 PM, Sarah kho wrote:
> Hi,
>
> Is there any OpenSolaris build with ZFS encryption support included out of
> the box? If not, is there any repository and a compatible openSolaris build
> to install the zfs crypto from that repostiory?
At this point in time, no builds of OpenSolaris
include ZFS crypto.


The feature has not been integrated.


James C. McPherson
--
Senior Software Engineer, Solaris
Oracle
http://www.jmcp.homeunix.com/blog

On 27/04/2010 12:02, Sarah kho wrote:
> Is there any OpenSolaris build with ZFS encryption support included out
> of the box?
No.
> If not, is there any repository and a compatible openSolaris
> build to install the zfs crypto from that repostiory?
No.

-- 
Darren J Moffat

James C. McPherson wrote:
> On 27/04/10 09:05 PM, Sarah kho wrote:
>> Hi,
>>
>> Is there any OpenSolaris build with ZFS encryption support included 
>> out of
>> the box? If not, is there any repository and a compatible openSolaris 
>> build
>> to install the zfs crypto from that repostiory?
>
> At this point in time, no builds of OpenSolaris
> include ZFS crypto.
>
>
> The feature has not been integrated.
>
Is there a target build for integration?

On 27/04/10 11:16 PM, Chad Feller wrote:
> James C. McPherson wrote:
>> On 27/04/10 09:05 PM, Sarah kho wrote:
>>> Hi,
>>>
>>> Is there any OpenSolaris build with ZFS encryption support included
>>> out of
>>> the box? If not, is there any repository and a compatible
openSolaris
>>> build
>>> to install the zfs crypto from that repostiory?
>>
>> At this point in time, no builds of OpenSolaris
>> include ZFS crypto.
>>
>>
>> The feature has not been integrated.
>>
> Is there a target build for integration?
No.


James C. McPherson
--
Senior Software Engineer, Solaris
Oracle
http://www.jmcp.homeunix.com/blog

Will it ever see the light of day?

I mean this seriously; with all the re-organisations and changes in
sun/oracle, is zfs-crypto an area that is part of the short/medium term
plan?

Regards,
Rob

-----Original Message-----
From: zfs-crypto-discuss-bounces at opensolaris.org
[mailto:zfs-crypto-discuss-bounces at opensolaris.org]On Behalf Of Darren J
Moffat
Sent: 27 April 2010 14:04
To: Sarah kho
Cc: zfs-crypto-discuss at opensolaris.org
Subject: Re: Which builds of OpenSolaris has ZFS encryption included?


On 27/04/2010 12:02, Sarah kho wrote:
> Is there any OpenSolaris build with ZFS encryption support included out
> of the box?
No.
> If not, is there any repository and a compatible openSolaris
> build to install the zfs crypto from that repostiory?
No.

--
Darren J Moffat
_______________________________________________
zfs-crypto-discuss mailing list
zfs-crypto-discuss at opensolaris.org
http://mail.opensolaris.org/mailman/listinfo/zfs-crypto-discuss

On 28/04/2010 07:42, Rob O''Leary wrote:
> Will it ever see the light of day?
Yes.
> I mean this seriously; with all the re-organisations and changes in
> sun/oracle, is zfs-crypto an area that is part of the short/medium term
> plan?
Yes.

-- 
Darren J Moffat

What timescale do you estimate? Log scales are ok(!): 1 month, 3 months, 10
months, 30 months?

Rob

-----Original Message-----
From: Darren J Moffat [mailto:darrenm at opensolaris.org]
Sent: 28 April 2010 09:49
To: Rob O''Leary
Cc: zfs-crypto-discuss at opensolaris.org
Subject: Re: Which builds of OpenSolaris has ZFS encryption included?


On 28/04/2010 07:42, Rob O''Leary wrote:
> Will it ever see the light of day?
Yes.
> I mean this seriously; with all the re-organisations and changes in
> sun/oracle, is zfs-crypto an area that is part of the short/medium term
> plan?
Yes.

--
Darren J Moffat

On 29/04/10 07:11 AM, Rob O''Leary wrote:
> What timescale do you estimate? Log scales are ok(!): 1 month, 3 months, 10
> months, 30 months?

We don''t provide estimates on when new features might
be integrated.


> -----Original Message-----
> From: Darren J Moffat [mailto:darrenm at opensolaris.org]
> Sent: 28 April 2010 09:49
> To: Rob O''Leary
> Cc: zfs-crypto-discuss at opensolaris.org
> Subject: Re: Which builds of OpenSolaris has ZFS encryption included?
>
>
> On 28/04/2010 07:42, Rob O''Leary wrote:
>> Will it ever see the light of day?
>
> Yes.
>
>> I mean this seriously; with all the re-organisations and changes in
>> sun/oracle, is zfs-crypto an area that is part of the short/medium term
>> plan?
>
> Yes.
>
> --
> Darren J Moffat
>
> _______________________________________________
> zfs-crypto-discuss mailing list
> zfs-crypto-discuss at opensolaris.org
> http://mail.opensolaris.org/mailman/listinfo/zfs-crypto-discuss

-- 
James C. McPherson
--
Senior Software Engineer, Solaris
Oracle
http://www.jmcp.homeunix.com/blog

> > Is there a target build for integration?
> 
> No.
Now for a question that''s probably not nice to ask:

Historically, when something that had reached a level
of maturity that there _was_ a target build,
it sometimes happened that we heard about it.

Given the new owner, might we still hear about
_approximate_ and _not_promised_ target builds for
at least _some_ features whose development was happening
pretty much in the open?

There''s been probably more than one mention that the new
owner''s
policy is perhaps more restrictive on something that might be
a future product announcement, but do features being added to
a maybe-maybe-not-altogether-supported development build
rise to that level?

PS If you don''t know, don''t want to take a chance, and would
rather
spend time coding than finding out, I personally don''t have a problem
with that.  But the clearer an idea people have of what info they
might reasonably expect, hopefully eventually the less often such
questions will get asked...if that sentence wasn''t so run on and
full of weasel words as to be almost meaningless...
-- 
This message posted from opensolaris.org

There are a lot of things going on just now, some as a result of changes 
in polices and some just because software development is a hard 
sometimes, especially crypto related things.

I''ve given dates in the past publically for this particular project and
obviously those have not been met.

So sorry but you just have to wait, it will be ready when it is ready.

-- 
Darren J Moffat

On Thursday, 2010-04-29, at 6:14 , Darren J Moffat wrote:
> There are a lot of things going on just now, some as a result of  
> changes in polices and some just because software development is a  
> hard sometimes, especially crypto related things.
Do you want to talk about the crypto related things?

I always thought that David-Sarah''s idea for convergent authenticated  
encryption of blocks:

http://article.gmane.org/gmane.comp.encryption.general/13719
http://mail.opensolaris.org/pipermail/zfs-crypto-discuss/2009- 
December/002974.html

Plus my idea for parallelizable MACs:

http://mail.opensolaris.org/pipermail/zfs-crypto-discuss/2009- 
December/002974.html

Was a really good idea because it made encryption always compatible  
with deduplication (i.e. you can start benefiting from deduplication  
without needing to first re-encrypt your entire filesystem) and  
allowed larger filesystems (up to 2^49 blocks instead of 2^33 blocks)  
without incurring a non-negligible chance of confidentiality failure  
due to IV collision.

I kind of assumed that one reason you didn''t go for that idea was  
that you had already finished your design and needed to finish the  
implementation sooner rather than later.

Regards,

Zooko

On 29/04/2010 16:41, Zooko Wilcox-O''Hearn
wrote:
> On Thursday, 2010-04-29, at 6:14 , Darren J Moffat wrote:
>
>> There are a lot of things going on just now, some as a result of
>> changes in polices and some just because software development is a
>> hard sometimes, especially crypto related things.
>
> Do you want to talk about the crypto related things?
>
> I always thought that David-Sarah''s idea for convergent
authenticated
> encryption of blocks:
>
> http://article.gmane.org/gmane.comp.encryption.general/13719
>
http://mail.opensolaris.org/pipermail/zfs-crypto-discuss/2009-December/002974.html
A decision in that area had already been made.

-- 
Darren J Moffat

Hello Darren,
Hello James,

I''m enthusiastic about this feature and I''m checking for new
mentions of it in various places every day.

I understand crypto to be extremely hard to get right, so I''m not
surprised that a large company is reluctant to rush anything of the sort.
>From the terse answers I understand the professional & organisational
situation to be be tense.  Please hang in there!  Larry has said that Sun had
phantastic engineers.  And in the time that I don''t use OpenSolaris, I
work in a large corporation myself -- please be patient.
I am currently using the "lofi" solution that Darren has explained in
his blog post.  It''s not pretty (no parallelism in disc access), but it
works (I''m slightly worried about my comprehension to controlling
redundant storage so that I don''t lose the keychain).

Thanks for the excellent work to Darren, thanks for the free software to
Snoracle (do you listen to the "JavaPosse" podcast?).

Oliver
-- 
This message posted from opensolaris.org