Re: encrypted swap - a schema proposal

Re: encrypted swap - a schema proposal

[Ahmed Masud]

On 23 May 2003, kernel wrote:

> Hello Ahmed
>
> question for you.  What about what Microsoft is purportedly doing for
> 2003 Server?  Wherein they use the public key model.  I.E., the
> pagefile.sys entire file is encrypted with public key and that exchange
> happens with a user or users who are then allowed to use it as needed.

Well this is currently achievable without doing any further work in its
most trivial form by using crypto loop devices.  The idea is to hide the
entire functionality from the users. Nothing that the user is doing should
change.

The model i proposed is designed under two main constraints:

1. User should be oblivious to any changes to the system.
2. We don't want to redesign the linux mm subsystem we just want to become
friends with it. ;)

Cheers,

Ahmed.

Re: encrypted swap - a schema proposal

[Ahmed Masud]

Hi Yoav:

I am sort of back, sorry for not getting back earlier but there i am sort
of juggling a couple of things right now ;)

Any how, here is a slightly different approach to our problem that may
solve some of these issues:

Maintain a seperate key-pair list seperately with an expiry, say with an
entropy factor determining the hard limit on the number of elements in the
list of the key-pair.

Take a page-based unique id, and map it to the keylist using some type of
bucket hashing scheme.

Add a page to a key's pagelist until a particular upper limit at which
case the key is flagged as retired and only will be used to decrypt any
pending pages, a new key will be added in its place.

A key may also retire after a soft timeout.  We can have kswapd or a
sibling run through the list and retire keys in one shot, or during a BH.

Round-robin :-) between keys.  The number of keys maintained and the
overhead etc. at a given time can now be significantly tuned by the system
administrator based on the exact resource requirements.

What do you think?

Ahmed.

On Sat, 17 May 2003, Yoav Weiss wrote:

> On Sat, 17 May 2003, Ahmed Masud wrote:
>
> > Hi Yoav:
> >
> > I have read your latest emails (ref, mm_struct and vma_struct), i am
> > just dropping a note to ack them because i won't have a chance to study
> > the points you make in detail over this weekend busy with something else.
> >
> > Cheers and a good weekend to you,
> >
> > Ahmed.
> >
>
> Have a good weekend too.  (mine is over now).
>
> When you're back, read Hugh Dickins' message re multiple mm's owning the
> same page in swap.  If it really works this way, we may have to assoc the
> keys with an even lower layer, and work harder on the relationship between
> pages and processes.
>
> 	Yoav
>
>