Re: eCryptfs Design Document

From: Phillip Susi
Date: Sat Mar 25 2006 - 14:26:23 EST


Michael Halcrow wrote:
* A mount-wide passphrase is stored in the user session keyring in the form of an authentication token.

I'm a bit confused because you appear to be contradicting yourself. You say several times that a mount-wide passphrase is used for the master key. If that is the case, then it would be given at mount time and be bound to the super block. You also then say that the master key is stored in the kernel keyring. If that is the case, then you don't have to know the key at mount time, rather the key is associated with a given process or group of processes and will be required when such a process attempts to open a file on that mount point. This would also allow different users to use different keys.


So which is it? Is the master key bound to the superblock, or to the session keyring? Or am I just confused about the meaning of the kernel keyring?

passphrase into a key follows the S2K process as described in RFC
2440, in that the passphrase is concatenated with a salt; that data
block is then iteratively MD5-hashed 65,536 times to generate the key
that encrypts the file encryption key.


Are you saying that you salt the passphrase, hash that, then hash the hash, then hash that hash, and so on? What good does repeatedly hashing the hash do? Simply hashing the salted passphrase should be sufficient to obtain a key.


-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/