Slashdot Mirror
OpenBSD can encrypt swapspace
Continuing it's reputation for security, the OpenBSD kernel can now
encrypt the contents of swap space, so that sensitive data can no longer
be swapped to disk 'in clear', where it could survive reboots. The
Blowfish cypher is used, as it is strong, fast, with a big key space.
Obviously, there's a small speed penalty for this option.
Note: The BSD section has been a little empty recently, due to
illness. Thanks to all who enquired after me, I appreciate it :-)
I don't use OpenBSD, so I wouldn't know. But under Linux (this is *NOT* a comparison, folks, just an observation!), there's the ide-scsi kernel module (it came as part of the standard kernel source with 2.2.13, don't know about earlier versions). It basically allows you to treat a standard ATAPI device (such as a CD-R or CD-RW) just like a SCSI device; changes the major/minor numbers, everything. It has allowed me to use my ATAPI CD-R with cdrecord, no problem.
Is there anything like that for BSD? I honestly don't know...
Yes, that's where the idea in Linux came from, BSD.
For years now, Linux users could do this.
We get our choice of crypto too, and can
even encrypt a whole disk.
Eat my turds, Satan!
(UNIX, being castrated, didn't have children.
Given the horns, I'd say your momma slept with
the devil himself.)
UNIX is a trademark licensed exclusively through
The Open Group.
Actually, I'm a commie.
Commies values freedom, BSDL is freedom without stupid restrictions, unlike GPL.
Btw, my girlfriend is from Sweden, so am I, so you might be right about that part.
In this paper you can read about implementation in FPGA.
"Last words are for fools who haven't said enough." - Karl Marx
Duh ! I suppose OpenBSD disabled the equivalent for /dev/mem & /proc/kcore for security reasons as well then ? Otherwise your argument doesn't really make sense, does it ?
The angry man always thinks he can do more than he can. -- Albertano of Brescia
True. But if root gets broken you're in trouble anyway.
Or maybe more than one person uses this computer. What is your lab mate with a boot floppy doing while you're at lunch?
Yep, realized that in the middle of class last night...
"But if root gets broken you're in trouble anyway."
But root can get broken temporarily WITHOUT knowing the root password. Retrieving this off of the swap partition gives the cracker access anytime.
A Government Is a Body of People, Usually Notably Ungoverned
up yo arse. openbsd doesnt even do smp yet.
Go found out a little bit more about security before you cast dispersions upon OpenBSD for being too paranoid in encrypting swap. I'll give you a hint: partitions are persistant.
A Government Is a Body of People, Usually Notably Ungoverned
It doesn't do SMP, but it fakes IDE CD-ROM burners as SCSI perfectly.
The best place to send it would be bkimmel1@mac.com
Nascantur in Admiratione. (Let them be born in Wonder)
Step 1;
- create a crypted filesystem
Step 2;
- create a swapfile in the crypted filesystem
Step 3;
- do a swapon on that swapfile.
Done!
This issue was a topic a while ago in the Linux kernel mailinglist. Someone actually tried the steps mentioned above here and found that it works!
point is not moot.
ANYBODY that gets their grubby hands on your hard drive can stick it into another box and "dd" the swapfile/swap partition off of it and subsequently peruse the contents thereof.
It looks like on DDN's forums, someone linked to both of them.. I think. I'm still downloading, to see. Oddly, my ethernet speeds seem to be tapping out at 6kb/s.. (a server I'm d/ling from now, at 6kbps, was in the 40s yesterday)
r y_id=515
http://daily.daemonnews.org/view_story.php3?sto
"Open Source?" - Press any key to continue
actually, commies don't really value freedom. They value communial ownership of the means of production (at least in the marx-derived version).
I'm sure the linux "me too"ers will chime in here about this or that, but, in the spirit of proactivity, let me peacefully remind everyone that BSD's father is Unix; Linux's father is Minix. The apple doesn't fall far from the tree or (in the case of linux) the turd doesn't fall far from the asshole.
Now we just need someone Outside the US to design and make a PCI encryptor/decryptor board that supports blowfish. If I had the ability to program programible logic devices I'd think about doing this just for myself, but then I'm also in the US so if I did it, I couldn't easily post the design or export it. With current programible logic encryption rates over 1M bytes a second should be possible.
Features that would be good. Write only key space. Space for a number of key sets. The OS can moderate who can use which key sets. It would use PCI bursting to transfer data to and from it. It would also need to handle common block chaining modes.
I figure it could be done on one large FPGA or similar. It may require a bank of fast SRAM for buffer space, but I think it could be done without. The actual card size could be miniscule. No larger than the length of the PCI connector and about 40mm high. One could even support a number of different encryption/decryption methods. I'd like to see DES, Triple-DES, Blowfish, Two Fish, RSA and maybe a few others.
What is the point in encrypting swap space? I doubt many people will be sniffing your HD. It would make a little more sense to encrypt your filesystem with your personal emails, papers, copyrighted material :snicker:, etc-- but swap space??
How true, how true. Let us remember the words of our great socialist leader, RMS:
Join us now and share the software
You'll be free hackers, you'll be free
Join us now and share the software
You'll be free hackers, you'll be free
Hoarders can make lots of money
That is true hackers, that is true
But they can not help their neighbor
That's not good hackers, that's not good
When we have enough free software
At our call, hackers at our call
Then we'll kick out those dirt licenses
Evermore hackers, evermore
Join us now and share the software
You'll be free hackers, you'll be free
Join us now and share the software
You'll be free hackers, you'll be free
and its even scarier when you hear the techno version! Now he just needs to rap it.. I mean if you can do a punk version of 'Leaving on a Jet Plane'.. almost anything is possible.
If someone had posted someting like this
"We, the the socialist Linux users of the world demand that Linux license everything that is encrypted into the swap space be licensed under the BSDL. Only by doing this can free health care, and the elimination of poverty be realized in the United States. Otherwise we will we be stuck in the 20th century forever."
would be marked as flamebait and would get a list of flames longer than the XFree86 sourcecode.
Fortanly, the OpenBSD community is smart enough not to endorse in flames.
Do you have a url to the techno version?
Nascantur in Admiratione. (Let them be born in Wonder)
I don't know about anybody else but I wish OpenBSD
would do a performance audit to go along with their much touted security audit. I just switched
to NetBSD x86 and noticed a substantial speed improvement. I also like the lack of hype and commitment to clean code. The userland tool chain
is very polished. Now I just have to figure out
how to burn CD-Rs from my atapi CD-RW. Last I heard cdrecord didn't like anything but scsi.
-Toaster
nope... just the file. Give me an email address or the like. Its very.. uhh.. cultish.
/. logged me in! And I was getting annoyed that it was to dumb to read its cookie...
whoohoo..
"Open Source?" - Press any key to continue