2

I am considering using OpenZFS on FreeBSD. I am not quite sure how secure native OpenZFS encryption is? If somebody steals my server and the disks, is he able to decrypt the files?

In a Discord room I found a possible answer:

Native ZFS encryption is still fairly new in the world of software encryption, and it doesn't hide as much through obfuscation as more well-established alternatives like LUKS and VeraCrypt (formerly TrueCrypt.) However, it lets you protect your data without losing the efficiencies and features of ZFS, even when the dataset is locked: creating snapshots, compression, incremental replications, etc.

Is that about right? Are there any important additions to the security of OpenZFS encryption?

Improve this question
1
  • What are your risks to consider?
    – kelalaka
    Dec 23, 2020 at 22:28

1 Answer 1

Reset to default
2

According to those slides explaining OpenZFS encryption, it appears that OpenZFS encryption is far stronger than LUKS or VeraCrypt encryption.

LUKS and VeraCrypt use the XTS mode of encryption, which is not authenticated, and is vulnerable to some limited recovery of information when an attacker can have access to the encrypted data at different times. On the other hand OpenZFS encryption is authenticated and at the state of the art. Also, you should take care to disable compression when encrypting with OpenZFS.

However, this authentication comes at a cost and is the reason it was not used in XTS: for every encrypted block in ZFS, 288 bits are used for authentication and encryption metadata (salt, MAC and IV). This is space that cannot be used to record data, so one can record fewer data on the same volume with OpenZFS than with XTS.

Improve this answer
2
  • 1
    As a side note, if you want more information on a very specific detail of the cryptography used, I suggest you ask on crypto.stackexchange.com
    – A. Hersean
    Dec 22, 2020 at 10:08
  • Authentication also requires calculation, consider one byte is changed then the once can change the encryption easily since AES-GCM uses CTR mode. Then the GMAC calculation is required. That is not a good idea and a rollback attack is always possible.
    – kelalaka
    Dec 23, 2020 at 22:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .