On Thu, Mar 20, 2014 at 09:23:14AM +0100, Stefan Hajnoczi wrote: > On Tue, Mar 18, 2014 at 01:30:44PM +0000, Daniel P. Berrange wrote: > > On Tue, Mar 18, 2014 at 02:08:19PM +0100, Stefan Hajnoczi wrote: > > > On Mon, Mar 17, 2014 at 08:48:08PM -0400, Hamilton, Peter A. wrote: > > > I guess the filter would be deployed below the image format: > > > qcow2 -> luks -> file > > > > I could see it being either above or below the image format at > > mgmt app's choice. Having it above the image format means only > > the payload is encrypted, so you can still query the basic > > metadata (like logic disk size, backing files) without decrypting, > > which is a nice aspect of the way qcow2 encryption historically > > worked. I could see though that people might want even the header > > encrypted to prevent anyone seeing anything about the image format > > without keys. > > The difference is that if you encrypt just the payload then dmcrypt > compatibility is much less useful since the data is now intermingled > with image format metadata.
You do get some crazy apps which format a block device with qcow2 though - eg oVirt. So conceptually even doing qcow2 inside a dmcrypt block could make some sense if apps like that setup! Regards, Daniel -- |: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :| |: http://libvirt.org -o- http://virt-manager.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|
