[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20130509074929.GA31074@openwall.com>
Date: Thu, 9 May 2013 11:49:29 +0400
From: Solar Designer <solar@...nwall.com>
To: owl-users@...ts.openwall.com
Subject: Re: Owl encrypted / and tcplay
Hi,
On Sat, May 04, 2013 at 03:45:51PM +0200, Zenny wrote:
> Is there a way to encrypt Owl / with aes-xts-plain64 which can be
> remotely authenticated remotely for decryption (like using dropbear in
> initrd or mandos server-client mechanism in debian using hooks)?
Perhaps there's a way by deviating from Owl, but it's not something we
support. As a supported alternative, you may consider using Owl's
OpenVZ host system in the way you would have used your initrd image, and
using an OpenVZ container in the way you would have used the encrypted
system. That is, simply place an OpenVZ container on an encrypted
filesystem, and only start it (maybe along with the entire OpenVZ
service) once the decryption passphrase is somehow entered and the
filesystem is mounted.
> Also interested in tcplay, but would be nice to know to securely
> integrated with Owl 3.0.
Well, for now we're only supporting cryptoloop, which I understand has
its drawbacks (lack of key stretching, no protection from watermarks -
which may or may not be relevant to a given use case). Perhaps we'll
need to start supporting dm-crypt.
Alexander
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
