On Tue 2018-06-26 12:30:24, Oliver Neukum wrote: > On Di, 2018-06-26 at 00:16 +0200, Pavel Machek wrote: > > Interested parties can easily fix up the userland parts of uswsusp, > > > > change crypto, add or remove dependencies, move it to other hosting, > > > > or drop it and start again. Kernel interface is flexible enough. If > > > > Chen wants to move the s2disk encryption into kernel, it is his task > > > > to explain why that is neccessary. > > We would have to assume that the kernel is on a higher level of trust. > To a certain extent it is.You cannot drop support for /dev/kmem conceptionally > if there is an ioctl to snapshot it.
If I understood the description, proposed patches give userspace encryption
key + image encrypted with that key. So... that's not really an
improvement.
Anyway, I guess it makes sense to wait for v2 of patches with better
description of security goals of this.
Pavel
--
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures)
http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html
signature.asc
Description: Digital signature
