On Tue, Mar 18, 2014 at 01:30:44PM +0000, Daniel P. Berrange wrote: > On Tue, Mar 18, 2014 at 02:08:19PM +0100, Stefan Hajnoczi wrote: > > On Mon, Mar 17, 2014 at 08:48:08PM -0400, Hamilton, Peter A. wrote: > > I guess the filter would be deployed below the image format: > > qcow2 -> luks -> file > > I could see it being either above or below the image format at > mgmt app's choice. Having it above the image format means only > the payload is encrypted, so you can still query the basic > metadata (like logic disk size, backing files) without decrypting, > which is a nice aspect of the way qcow2 encryption historically > worked. I could see though that people might want even the header > encrypted to prevent anyone seeing anything about the image format > without keys.
The difference is that if you encrypt just the payload then dmcrypt compatibility is much less useful since the data is now intermingled with image format metadata. But I agree in some cases it may be the right thing to do.
