Slashdot Mirror
NetBSD's Crypto-Graphic Disk
An anonymous reader writes "Security-minded laptop users live in fear of theft, not only of their computer but also of their precious secret data. NetBSD's CGD project is a cryptographic virtual disk that can protect sensitive data while acting like a normal filesystem. Recently its author, Roland Dowdeswell, was interviewed and provided a lot of details, and made a comparison with Linux's Loop-AES, FreeBSD's GBDE, OpenBSD's svnd.
This is a must-read for any laptop owner (and paranoid androids)!"
God do I love the smell of slashdot in the morning!
_?88____________________88P______`8P
__88b__________________d88
__888888b__.d888b,_d888888________88b_.d888b,
__88P_`?8b_?8b,___d8P'_?88________88P_?8b,
_d88,__d88___`?8b_88b__,88b______d88____`?8b
d88'`?88P'`?888P'_`?88P'`88b____d88'_`?888P'
______d8b________________________d8b
______88P________________________88P
_____d88________________________d88
_d888888___d8888b_d888b8b___d888888
d8P'_?88__d8b_,dPd8P'_?88__d8P'_?88
88b__,88b_88b____88b__,88b_88b__,88b
`?88P'`88b`?888P'`?88P'`88b`?88P'`88b
It is official; Netcraft now confirms: *BSD is dying
One more crippling bombshell hit the already beleaguered *BSD community when IDC confirmed that *BSD market share has dropped yet again, now down to less than a fraction of 1 percent of all servers. Coming on the heels of a recent Netcraft survey which plainly states that *BSD has lost more market share, this news serves to reinforce what we've known all along. *BSD is collapsing in complete disarray, as fittingly exemplified by failing dead last in the recent Sys Admin comprehensive networking test.
You don't need to be a Kreskin to predict *BSD's future. The hand writing is on the wall: *BSD faces a bleak future. In fact there won't be any future at all for *BSD because *BSD is dying. Things are looking very bad for *BSD. As many of us are already aware, *BSD continues to lose market share. Red ink flows like a river of blood.
FreeBSD is the most endangered of them all, having lost 93% of its core developers. The sudden and unpleasant departures of long time FreeBSD developers Jordan Hubbard and Mike Smith only serve to underscore the point more clearly. There can no longer be any doubt: FreeBSD is dying.
Let's keep to the facts and look at the numbers.
OpenBSD leader Theo states that there are 7000 users of OpenBSD. How many users of NetBSD are there? Let's see. The number of OpenBSD versus NetBSD posts on Usenet is roughly in ratio of 5 to 1. Therefore there are about 7000/5 = 1400 NetBSD users. BSD/OS posts on Usenet are about half of the volume of NetBSD posts. Therefore there are about 700 users of BSD/OS. A recent article put FreeBSD at about 80 percent of the *BSD market. Therefore there are (7000+1400+700)*4 = 36400 FreeBSD users. This is consistent with the number of FreeBSD Usenet posts.
Due to the troubles of Walnut Creek, abysmal sales and so on, FreeBSD went out of business and was taken over by BSDI who sell another troubled OS. Now BSDI is also dead, its corpse turned over to yet another charnel house.
All major surveys show that *BSD has steadily declined in market share. *BSD is very sick and its long term survival prospects are very dim. If *BSD is to survive at all it will be among OS dilettante dabblers. *BSD continues to decay. Nothing short of a miracle could save it at this point in time. For all practical purposes, *BSD is dead.
Fact: *BSD is dying
what I know about *BSD
1. You can not play games on it.
2. It cannot be used by my grandma.
3. It lacks a GUI of any note.
4. There is no support available for it.
5. It is an assortment of fragmented OSes.
6. It cannot be run on the x86 platform.
7. You have to compile everything and know C.
8. Support for the latest hardware is always poor.
9. It is incompatiable with GNU/Linux.
10.It is dying.
Elegy For *BSD
I am a *BSD user
and I try hard to be brave
That is a tall order
*BSD's foot is in the grave.
I tap at my toy keyboard
and whistle a happy tune
but keeping happy's so hard,
*BSD died so soon.
Each day I wake and softly sob
Nightfall finds me crying
Not only am I a zit faced slob
but *BSD is dying.
So the CGD disk is an encrypted pseudo disk driver. It sits on top of another partition and acts as a new virtual disk to the rest of the operating system. But what of those of us that have to use windows, or Mac OS X? This seems like it's only compatible with *nix OSes.
The theory of relativity doesn't work right in Arkansas.
Why do you think that Marvin's brain was running NetBSD? Otherwise, what use could he make of a laptop, with his "brain the size of a planet" ?
This is interesting and all, but this isn't exactly a ground-breaking news item.
PGP lets you do this on various platforms.
As a matter of fact, this is how I manage personal info on my OS X Macintosh. I create an strong-encrypted virtual disk image with banking, internet login, software key, and (un)related information. When I need something I mount it and when I'm done I umount it and it's nice and safe (as long as I never tell Keychain to remember the password).
You can do this on a vanilla OS X install with Disk Utility.
ffakr
I'm not feeling witty so bite me
God do I love the smell of slashdot in the morning!
/. smells like Garlick in the morning, in Germany it reeks of whats left over of a stew made out of last weeks left over knockwurst, In the USA like it smells lukewarm spray-on cheese and in the UK I hear it smell like a glass half full of stale Guinness covered by a layer of cigarette butts. Where are you from?
Do you? In France
This is a great idea, honestly... but who runs NetBSD on their laptops? I'd posit that it's a relatively low amount of folks. So while this is cool, until the code migrates to a better known F/OSS OS it isn't much use in the real world.
If thou see a fair woman pay court to her, for thus thou wilt obtain love
What happens if cdgconfig file is lost or damaged?
If you lose the cdgconfig file, is your data irrecoverable?
When it overwrites data, is it truly unreadable?
How taxing is this system, how long does it take to execute?
What happens when you lose your PW?
Are there knowledgable people in the same continent that can provide support for this?
He who knows best knows how little he knows. - Thomas Jefferson
Free BSD versus Windows XP
XP: Has the most advanced and easy to use GUI available.
FreeBSD: Has no GUI of note.
XP: Supported by the world's largest and most trusted software company.
FreeBSD: Supported by some losers who got kicked off of the 386BSD core team
XP: Available for free preinstalled on computers from every major manufacturer.
FreeBSD: Available for free as an unstable source release that you have to compile yourself in C and then manually build your own base system.
XP: Stable and reliable, and scalable from the desktop to the datacenter.
FreeBSD: Basically unusable due to major bugs. And it doesn't fix FreeBSD's SMP problems, so don't worry about running it on your server.
XP: Everyone else uses it, so it has all the popular software.
FreeBSD: It runs...uh...vi...and...uhm...thats it actually...
XP: Microsoft has a licensing agreement with SCO, so all SCO IP is fully licensed when you buy a licensed copy of XP!
FreeBSD: You may be liable for the same $699 licensing fee as linux users if you use it, after all, Microsoft is already paying licensing fees for the same code.
XP: Alive
FreeBSD: Dead
As you can see, Free BSD is the clear choice!
This appears to be the same as linux's cryptoloop (loop-aes, etc), or am I missing something?
It's nothing really special, until it's implemented so laptop users can easily set up an encrypted root filesystem and be able to boot into it easily.
If it acts like a normal filesystem, that means that nothing special needs to be done to access it, provided you have an account with rights to use that filesystem (I'm assuming it needn't be root). So what if the person stealing your laptop gets a hold of your password? How does it become any more secure?
In retrospect, most BSD users probably don't keep their passwords on a sticky note inside their laptop like some Windows users I know...
TrueCrypt is disk encryption software for Windows XP/2000/2003 and Linux. Version 4.1 was released last month. It seems to have been designed by people who are VERY serious about encryption. For example, TrueCrypt "provides two levels of plausible deniability".
if you remember to encrypt any partitions that temporary data might possibly reside on... cos it would be awfully silly to protect your home partition and forget /var or /tmp or the swap... why not be completely paranoid and encrypt the the volatile "partition" that gets created in memory
Donald 'Duck' Dunn: We had a band powerful enough to turn goat piss into gasoline.
"Last Disk" [to the tune of Last Kiss by pearl jam]
Oh where, oh where is my BSD?
I just loaded Beta 5.3
It's gone to heaven, so I've got to be good,
So I can see the OS when I leave this world.
I'd started to load it in my roommate's Dell,
the hard drive was taking it pretty well.
During the load, it crashed the heads,
the distro was stalled, *BSD was dead.
I couldn't stop, so I yanked the cord.
I'll never forget, the sound , oh Lord--
the screamin' drives, the speaker's blast,
the painful scream that I-- heard last.
Oh where, oh where is my *BSD?
That load took it away from me.
It's gone to heaven, so I've got to be good,
So I can see *BSD when I leave this world.
When I woke up, the sparks were pourin down.
There were admins standin all around.
Some burned-out chips had fallen on the tiles,
but somehow I found my disc of files.
I lifted the CD, the devil winked and said,
"Load me darlin just a little while."
I held it close, I kissed the label--our last kiss.
I found the love that i knew i had missed
well now it's gone, even though I loaded it right
I lost my *BSD and the Dell-- that night.
Oh where, oh where is my *BSD?
I tried to load it yesterday.
It's gone to heaven so I've got to be good,
So I can see *BSD when I leave this world.
When I next went to Slashdot, where so many had trolled.
Any so many times "BSD's Dead!" was told.
Tears fallin' on the keyboard, I checked "Anonymous"
and I eulogized *BSD, in memory, of us....
When I logged on next, my post was modded down.
In my heartbreak and sorrow, treated like a clown....
No matter what the mods do, it's in my heart and head
We'll always know "*BSD IS DEAD!"
Oh where, oh where is my *BSD?
I tried to load it yesterday.
It's gone to heaven so I've got to be good,
So I can see *BSD when I leave this world.
I heard some retard said Jordan Hubbard left FreeBSD development.
I wonder where Jordan went.. bet he's writing Windows software now..
Oh wait, Jordan Hubbard is leading work at Apple on that OS X thingy they have.. you know, the FreeBSD based OS with that Darwin open source core thingy.
Poor beleagured Apple, they'll be out of business any day now.
Oops. Scratch that.
Poor beleagured FreeBSD, they'll be out of buisness any day now.
Oops. Scratch that.
Poor beleagured OpenBSD. They'll..... got to blow my nose, excuse me.
I'm not feeling witty so bite me
Windows?
From the summary: "Security-minded laptop users live in fear of theft"
Nice blanket generalization there. I'm security minded, use two laptops, and I don't live in fear. I mitigate risks. I use caution, but I don't live out my life in a state of fear, as your cliche ridden statement says.
Karma be damned, but I'm sick of people who use phrases without thinking what they actually mean.
Bestcrypt is probably only solution supporting Linux AND Windows. Windows version is a shareware, but Linux version is a free (as a beer).
So the CGD disk is an encrypted pseudo disk driver. It sits on top of another partition and acts as a new virtual disk to the rest of the operating system. But what of those of us that have to use windows, or Mac OS X? This seems like it's only compatible with *nix OSes.
/Applications/Utilities/Disk Utility.app, select File->New->Blank Disk Image... Once created this can be accessed by double clicking it and feeding it the password.
OS.X ships with something called Filevaut, accessable from 'System Preferences'. Filevault migrates your home directory onto an encrypted image using a 128-bit AES key which, AFAIK is pretty secure, at least the NSA sponsored OS.X security guide I read recently recommended using it. This image gets mounted onto your Home directory when you log in and cannot be accessed unless you either know the login password or somehow manage to crack the encryption on the image file. This is useful for mobile professionals and the on the fly encryption works surprisingly well unless you are working with say, Photoshop files that weigh in in the hundreds of megabytes. For day to day stuff this works quite well. Just for example, I keep my iTunes collection on a filevault image and it does not seem to kill performance even with resource hogs like MS Word and Excel running.
If you only want a small secure area rather than encrypting the entire Home directory like you do with Filevault you can also create stand alone *.dmg images with the 'Disk Utility'. These have the same 128-bit AES encryption as Filevault. Fire up
Only to idiots, are orders laws.
-- Henning von Tresckow
I for one welcome our paranoid android overlords!
In Soviet Russia, paranoid of androids is you!
I'm a paranoid android, you insensitive clod!
Imagine a beowulf cluster of paranoid androids!
Yup, that was pretty awful.
It's called FileVault. Just go to one's system preferences, select FileVault, set the password and bingo!
In Amsterdam is smells like weed... I can tell... ;)
I don't know about BSD, but with Windows there is always the danger that the OS itself or other programs are making copies of data and filenames and storing them in the registery, .ini files or a thousand other possible places which may not be encrypted. Encrypting the entire OS from boot on up seems like the only genuinely secure way to prevent this problem.
You can setup encryption for any homefolder in Xandros right from the user admin section of Control Ceenter. It uses keyfiles and supports the algorithms you listed plus about six others.
NetBSD will be exhibit at SCALE 4x
Actually, no BSD's have /proc. BSD's use sysctl. Linux uses /proc.
All editorial writers ever do is come down from the hill after the battle is over and shoot the wounded.
Under Windows, you can use Private Disk (AES 256-bit, with certification from NIST; use multiple encrypted drives simultaneously), it comes with a lot of features, my favourite one being 'Disk Firewall'. This is an application-level filter that doesn't exist in programs like TrueCrypt or BestCrypt, etc. This thing allows you to control which application can access the drive, while the others (i.e. viruses, spyware and other #^!#$^!ware) are rejected.
The program runs off removable drives too (there are certain particularities.. but once you know what you're doing, it works).
The saddest poem
Try these
:-)
Private Disk (lots of features, highly customizeable)
Private Disk Multifactor (Comes with biometry and smart card authentication)
Private Disk Light (this is the free version)
I wrote about these tools in an earlier post. I am very satisfied with this thing, bought it for half the price - student discount
The saddest poem
Reading the first few lines of the interview I get the impression it does almost the exactly the same stuff dm-crypt does, which has been in Linux stable for over a year now.
Have a look at http://luks.endorphin.org/
In my opinion, there has been some excellent work been done.
Is it possible to encrypt your entire system
or anything except the boot partition since i dont think
the boot loaders support crypto yet
Can someone spread some light on this
It's possible you know about cryptography, but you don't seem to know much about networking... how exactly do we check your ip address?
That said, I don't know anything about CBC and I expect your point is 100% correct. It's just painful to see such a statement from someone purporting to inform me about computer related information.
I use loop-aes when I want an encrypted drive. Setting it up the first time sure is a pain, though.
In fact the real beauty of this solution is that it can be set up to replace the standard windows login with one which uses the TPM, and can then 'unlock' as much or as little of your other TPM secured data as you like. My only complaint is that the password manager doesn't work w/ Firefox/Thunderbird, so I can't have TRUE single sign-on. But if I were to just use IE, it would be.
I have been burned many times in the past by development filesystems, and drivers. It sounds like a great idea, but I am going to wait quite some time before I trust my data with it.
SuSE supports encrypted disks without the use of the commandline. Does anyone have any comment as to the security or the recoverability of the SuSE system?
Windows has the Encrypted Filesystem built into NTFS.
p pro/deploy/cryptfs.mspx
http://www.microsoft.com/technet/prodtechnol/winx
[RIAA] says its concern is artists. That's true, in just the sense that a cattle rancher is concerned about its cattle.
Does someone know if openbsd still uses encypted file systems by default? Is this basicly something like that but for netbsd?
That's what he said: he uses PGP Disk, not Filevault you stupid asswipe
It's interesting to see xxxBSD user/developer comparing "just written" software for BSD with ancient versions of Linux counterparts and (surprisingly) finding xxxBSD version to be better. My point being: dm-crypt.
If you are interested in Linux 2.6 encrypted partition, use dm-crypt together with cryptsetup tool. It's much safer than AES loop and:
OK, I'm tired, go read the links and you'll be much wiser and better informed than after reading TFA ;)
Robert
Bastard Operator From 193.219.28.162
He seems to have a relevant worry about the lack of atomicity when writing to a GBDE encrypted device. However he fails to notice that this happens only because GBDE has addressed a problem which every other disk encryption seems to have ignored. You get certain security advantages from probabilistic encryption. But probabilistic encryption implies the encrypted version must be slightly larger than the clear text.
More than once has the use of deterministic encryptions lead to weaknesses in disk encryptions. And often the workarounds require additional CPU power. And even the most careful deterministic encryption can never be as secure as a probabilistic encryption.
GBDE does have probabilistic encryption. This also means that obviously an update requires more than one physical write. Though this could be done securely, the way it is done in GBDE seems to give a risk of data loss/corruption. Some kind of journaling could have solved the problem. Having journaling both in the encryption and in the file system seems to be overkill (and clearly hurts performance), but integrating the two without compromising security is nontrivial. I'd like to see some more research in this area.
From my description it may sound like from a cryptographic viewpoint GBDE is the best designed disk encryption in existence. Unfortunately it isn't so. It did get some things right, but it seems to be mostly by luck. GBDE uses different pseudo random keys for each sector, however rather than using a standard PRNG, PHK decided to invent his own known as the Cherry Picker. Unfortunately there is a weakness in this generator as the output is not uniformly random.
To the best of my knowledge GBDE is currently the only disk encryption making use of probabilistic encryption, and none of the disk encryptions in existence make a serious effort at guaranteeing integrity (also known as security against an active adversary).
Do you care about the security of your wireless mouse?
Learn the CLI....It is SO worth it!
Okay, I RTFA, and still don't see why there is a hyphen in "crypto-graphic" here. I thought perhaps it was some cute way to use a graphics card to do the the encoding, but I think it's (don't laugh) a typo. Please correct me if I'm wrong.
I've only just begun using TrueCrypt, but my experience, also, is that it just works, also. I like making and maintaining a container, which can be moved to a thumb (flash memory) drive for traveling.
I like the command line options of TrueCrypt.
Most importantly:
1) Reading the web site and documentation gives me the impression the developers know what they are doing. I like it that, in the comments above, the developers are criticized for an incorrect statement about block chaining, and the error was corrected immediately.
When I read the web sites and documentation of commercial encryption products, so much is written by bored marketing people that I fear that the company is controlled by someone who majored in English Literature. (Nothing against majoring in Eng. Lit., but such people should not have control over products that require advanced understanding of technology.)
2) To me, it is absolutely necessary that any encryption software I use be Open Source. I fear that a rogue employee or a an owner of a commercial encryption software company would put in a back door, or would introduce a weakness.
The U.S. government has decided that it can secretly force companies to help in surveillance. This means that commercial companies cannot be trusted. (The drawbacks of secret action are called "Blowback" by some in the U.S. government. Blowback is not seen as a bad thing, because if decreases the political stability in the world, which means that employees of U.S. government secret agencies will get raises and promotions.)
For conventional encryption, like sending encrypted files automatically to a private FTP site for safe offline storage, I use Gnu Privacy Guard. Also Open Source, of course.
"... how exactly do we check your ip address?"
When I read that, I assumed he meant that a Slashdot editor could check his IP address.
I know that Slashdot editors sometimes read the stories they post, because, when I criticize the Bush administration, sometimes I am moderated down multiple points, without the moderation appearing in the karma points summary at the end of the comment. In the middle of the night, while Slashdot editors are presumably sleeping, people in other countries moderate the comment to +5. The comment is then bulk moderated down when it is morning in the United States. Just guessing, but it is plausible.
This comment may seem a little off topic, other than being an answer to an on topic thread, but it is relevant because encryption like that provided by TrueCrypt is more necessary in times of political instability and government corruption.
This is one example of how a F/OSS _becomes_ more popular. Don't count a runner out of a race which never ends.
Cross Crypt - Open Source AES and TwoFish Linux compatible on the fly encryption for Windows XP and Windows 2000.
It uses the excellent Filedisk to appear as a volume in Explorer.
It's GPL, sorry to restate that, but I dunno if you read the headline fully or not.
[% slash_sig_val.text %]
Hey -- I'm no crypto, OS or FS guru, how does this compare/differ from Apple's FileFault which provides on the fly encrypt/decrypt of user files? Being an Apple user, I have yet to use the FileVault utility, but it does look enticing, just that encrypting files on my workstation doesn't seem worth the *anticipated* performance hit.
Perhaps this might be yet another *BSD project that Apple could benefit from ala Konqueror. Or not.
"... you are probably just another liar."
Ahhh, the civilized and polite interaction for which Slashdot is famous.
Thankyou for making me skim through your cruft--flames of the BSD's--rather than discussing the article at hand. Lets talk about the article in the stead of opinions and unreliable and misleading surveys, shall we?
I'd like to point out that the article notes that OpenBSD's svnd does not provide salting of the password, thus leaving it more open to dictionary attacks. Rather, Blowfish is NOT fast when changing keys. Blowfish is much slower than almost all block ciphers when computing a new key. Blowfish, especially the version found in OpenBSD, has a slow key schedule, which does make it resistent to dictionary attacks by requiring lots of computation.
Facts.
If you look at its history they are just within the last few months starting to get their shit together. The beginning of the project was controversial and for the first few versions there was no solid group running it. They also btw just recovered from a major flaw in their deniability scheme.
By all accounts it appears to be shaping up into a solid project, but IMHO you wouldn't be acting too conservatively if you waited another year to look into their project. A project that starts out with disputed code, then has no formal website, and then finally has one of their major features coded incorrectly, seems to be growing through some serious growing pains to put it mildy.
And THAT is why you don't every crypto expert out there applauding Truecrypt yet. Like I said the problems seem to be a thing of the past, but for anything but home use I'd wait another year or so to make sure they are on the right track and the project won't fizzle out have more organizational problems.
Seagate has announced a laptop disk that does full disc encryption in hardware, without slowing down disc I/O at all. Seems like that makes software solutions (which are subject to reverse engineering, etc.) decidedly inferior.
... an idea, the fugitive fermentation of an individual brain ... -- T. Jefferson
I guess you missed the part where he said he used Disk Utility. PGP Disk wasn't mentioned. Who's stupid now?
-jcr
The only title of honor that a tyrant can grant is "Enemy of the State."
Many good reasons.
Thanks to the poster above who pointed this out to me...
:) The write operations took a lot of CPU cycles in kjournald (I'm using ext3 so you may get better speeds with other filesystems).
I am using dm-crypt on top of a level 5, 3 disk SATA raid.
The system just used a normal aes.ko module so I decided to try the aes-i586.ko module (the server is a Athlon XP 2400+ with 512 MB RAM).
Here are my results:
Control Read test file (non-crypted)...
1) 0.01user 1.43system 0:17.99elapsed 8%CPU
2) 0.03user 1.43system 0:18.07elapsed 8%CPU
3) 0.03user 1.43system 0:17.94elapsed 8%CPU
AES
===
Write test file....
1) 0.05user 4.99system 0:53.26elapsed 9%CPU
2) 0.05user 4.88system 0:52.85elapsed 9%CPU
3) 0.06user 4.87system 0:50.14elapsed 9%CPU
Read test file....
1) 0.03user 2.00system 0:36.44elapsed 5%CPU
2) 0.03user 1.97system 0:36.99elapsed 5%CPU
3) 0.03user 1.94system 0:35.55elapsed 5%CPU
AES-i586
========
Write test file....
1) 0.06user 4.65system 0:42.12elapsed 11%CPU
2) 0.03user 4.90system 0:40.38elapsed 12%CPU
3) 0.04user 4.77system 0:42.02elapsed 11%CPU
Read test file....
1) 0.03user 1.87system 0:22.22elapsed 8%CPU
2) 0.04user 1.91system 0:21.80elapsed 8%CPU
3) 0.02user 1.90system 0:22.00elapsed 8%CPU
As you can see the results with aes-i586 are significantly better
Does anyone know of any reason not to use aes-i586.ko?? I assume they are exactly equiv?
Anyways, I've added the line:
alias aes aes-i586
to my modprobe.conf.
Cheers for the advice.
Cgd is several years old, its not new at all.
What happens when the disk drive dies?
The answer is the same as for your questions, you restore the backup that you've been told countless times to make. You do have one, right?
Would this be easily ported to other BSDs, Linux, or even Windows?
FPFPFPFPFPFP YOUR MOM STANDS FOR FP haha suck you you fisherole cassiorole BAHAHA lololollmaolmaoroflmaoqzx spam tastes NICE!The omnipotence paradox is a paradox arising from the attempt to apply logic to the notion of an omnipotent being. It appears when one asks whether or not an omnipotent being is able to perform actions that would limit its own omnipotence, thus becoming non-omnipotent. Some philosophers see it as proof of the impossibility of the existence of any such entity; others assert that the paradox arises from a misunderstanding or mischaracterization of the concept of omnipotence. In addition, several philosophers have considered the assumption that a being is either omnipotent or non-omnipotent to be a false dilemma, as it ignores the possibility of varying degrees of omnipotence (Haeckel).
The paradox is often based on the God of the Abrahamic religions, though this is not a requirement. Since the Middle Ages, philosophers have phrased the paradox in many ways, of which the classic example is, "Could an omnipotent being create a stone so heavy that even that being could not lift it?" This particular statement has subtle flaws (discussed below), but as the most famous version, it still serves adequately for illustrating the different ways the paradox has been analyzed.
In order to analyse the omnipotence paradox in a rigorous way, one must first establish the precise definition of omnipotence. The definition of omnipotence varies amongst cultures and religions, and from one philosopher to another. A common definition is "all-powerful", but that is insufficient for the omnipotence paradox. This paradox cannot be formulated, for example, if one defines omnipotence as the ability to operate outside the constraints of any logical framework. Modern approaches to the problem have involved the study of semantics, debating whether language--and therefore philosophy--can meaningfully address the concept of omnipotence itself.Philosophical responses
A common example of the omnipotence paradox is expressed in the question, "Could an omnipotent being create a stone that it could not lift?" It is possible to analyze this question in the following manner:
The being can either create a stone which it cannot lift, or it cannot create a stone which it cannot lift.
If the being can create a stone which it cannot lift, then it is not omnipotent.
If the being cannot create a stone which it cannot lift, then it is not omnipotent.
This mirrors the solution to another classic paradox, the irresistible force paradox: What happens when an irresistible force meets an immovable object? A response to this paradox is that if a force is irresistible, then by definition there is no truly immovable object; conversely, if an immovable object were to exist, then no force could be defined as being truly irresistible. This treatment of the paradox remains true to the basic assertions, but does not address the issue of the definition of omnipotence. Furthermore, the omnipotence paradox is related to another similar philosophical question, the grandfather paradox. The vernacular definition of omnipotence often seems to include the ability to travel across time; one could then ask the question, "Can an omnipotent being go back in time and kill his own grandfather?" This is not, however, a logically satisfactory analysis of the paradox, as it tends to focus on the imposition of human attributes onto a being that is not necessarily of human form (Wierenga).
One can also attempt to resolve the paradox by postulating that omnipotence does not necessarily demand that a being must be able to do all things at all times. Thus, one reasons,
The being can create a stone which it cannot at that moment lift.
However, being omnipotent, the being can always later reduce the weight of the stone to a weight where it can lift it. Therefore the being is still legitimately omnipotent.
This is essentially the same view espoused by Matthew Harrison Brady, a character in Inherit the Wind loosely based upon William Jennings Bryan
DO NOT TRUST IT.
If you want this on Linux, you can do it with the device mapper system. Just run dmsetup on a loopback device (setup with losetup), and mount it like a normal block device.
The kernel supports all kinds of block encryption including AES with different key sizes.
What it lacks is an easy-to-use interface to setup and maintain.