---------- Forwarded message ---------- From: grarpamp <grarpamp@gmail.com> Date: Thu, Jun 19, 2014 at 2:27 PM Subject: Re: [cryptography] [Cryptography] encrypting hard drives (was Re: Shredding a file on a flash-based file system?) On Thu, Jun 19, 2014 at 4:18 PM, Dan McDonald <danmcd@kebe.com> wrote:
ZFS crypto, closed-source thanks to Oracle, was supposed to address this problem. Its design was to apply crypto in the "ZIO" path, like it does for checksums. I've not used Oracle Solaris, but apparently ZFS crypto is in there and it supposedly works.
And as in the design papers/blogs, Oracle ZFS seems to have some data that is not encrypted that arguably should be. https://blogs.oracle.com/darren/entry/zfs_encryption_what_is_on
And let me state for people wondering, "Why isn't it in OpenZFS already?"
In the OpenZFS world, you deploy each OS's FDE underneath ZFS. OpenZFS will likely add native encryption feature flag someday to satiate those who want per dataset keying, etc... but, thanks to Oracle, anything post zfs28/zpool5 might not end up interoperating. https://en.wikipedia.org/wiki/ZFS http://www.open-zfs.org/