Date: Thu, 9 May 2013 11:49:29 +0400 From: Solar Designer <solar@...nwall.com> To: owl-users@...ts.openwall.com Subject: Re: Owl encrypted / and tcplay Hi, On Sat, May 04, 2013 at 03:45:51PM +0200, Zenny wrote: > Is there a way to encrypt Owl / with aes-xts-plain64 which can be > remotely authenticated remotely for decryption (like using dropbear in > initrd or mandos server-client mechanism in debian using hooks)? Perhaps there's a way by deviating from Owl, but it's not something we support. As a supported alternative, you may consider using Owl's OpenVZ host system in the way you would have used your initrd image, and using an OpenVZ container in the way you would have used the encrypted system. That is, simply place an OpenVZ container on an encrypted filesystem, and only start it (maybe along with the entire OpenVZ service) once the decryption passphrase is somehow entered and the filesystem is mounted. > Also interested in tcplay, but would be nice to know to securely > integrated with Owl 3.0. Well, for now we're only supporting cryptoloop, which I understand has its drawbacks (lack of key stretching, no protection from watermarks - which may or may not be relevant to a given use case). Perhaps we'll need to start supporting dm-crypt. Alexander
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.