Hi Gwendal, On Fri, Apr 21, 2017 at 10:21:16AM -0700, Gwendal Grignou wrote: > > > > In any case, I guess that unless there are other ideas we can do these patches: > > > > 1.) f2fs patch to start checking the name, as above > > 2.) patch to start encoding last 32 bytes of the name (or second-to-last CTS > > block, I haven't decided yet) rather than last 16 bytes, changing > > fs/crypto/, fs/ext4/, and fs/f2fs/ > > Using second-to-last CTS block is CTS-CBC specific. If we use another > method to encode filename (I am thinking of HEH, > http://www.mail-archive.com/linux-crypto@xxxxxxxxxxxxxxx/msg21826.html) > that may not work anymore. > We don't have to use the last 32 bytes: using for instance the last 24 > should be good enough, the escape rate will be 1/2^64 instead 1/2^128. > The thing is, even using the last N bytes is depending on the encryption algorithm. The only way to make it work for arbitrary algorithms would be to use a cryptographic hash like SHA-256 --- which actually seems to have been the original design, but apparently it got changed at some point. (I guess so that hashes wouldn't have to be computed in so many places, and taking advantage of the encryption should be sufficient.) HEH is not a problem because it's a strong pseudorandom permutation, so any choice of bytes from the ciphertext is equally good for it. We can always change this later if different algorithms are added, or even make different algorithms choose different bytes. So I think I'm leaning towards making it use the second-to-last block, rather than the last 32 bytes. Eric -- To unsubscribe from this list: send the line "unsubscribe linux-fscrypt" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
![]() |