From owner-freebsd-hackers@freebsd.org Tue Sep 8 22:10:16 2015 Return-Path: Delivered-To: freebsd-hackers@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id F3D369CDAAD for ; Tue, 8 Sep 2015 22:10:15 +0000 (UTC) (envelope-from mozolevsky@gmail.com) Received: from mail-io0-x22f.google.com (mail-io0-x22f.google.com [IPv6:2607:f8b0:4001:c06::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id BB04F17B3 for ; Tue, 8 Sep 2015 22:10:15 +0000 (UTC) (envelope-from mozolevsky@gmail.com) Received: by ioiz6 with SMTP id z6so1264684ioi.2 for ; Tue, 08 Sep 2015 15:10:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:sender:in-reply-to:references:from:date:message-id :subject:to:cc:content-type; bh=6jFjYSFJ8ZKC2yN11G4NcuaYXHW/SbnKW3w+vKr3jEY=; b=SU8ag3jqtpdhacRetTRFqbundph0Q5CTJ3tNPpfbqWJojybzk/uWy224l2hAI3zbA4 j7AS2HXub0ALMckxB0zVSOgBdKIzXta625T8bWTZZ+c1aSVGloyc4H30ILOktRvH4A5D bdEuzJGtqHboSwOcpwlXhoSwjxPph3WLdEQePjPSeLtOLcp13e1YCbvJoodlLXlBTMgA U9PMYgqoxJPtIrn+0dS7hTrSbtvKI7uRUTTj+NJ2pYnPdO7dy4ChEqXcoBDIvLqSg7zR x1Pjgb4koWcdhnJSpiQa87PgurnT4bFPZu7qVi+ZCX4KWLonH7fUG8jrWc9aZgmZygqn LvHA== X-Received: by 10.107.16.80 with SMTP id y77mr42267059ioi.183.1441750215066; Tue, 08 Sep 2015 15:10:15 -0700 (PDT) MIME-Version: 1.0 Sender: mozolevsky@gmail.com Received: by 10.79.92.198 with HTTP; Tue, 8 Sep 2015 15:09:35 -0700 (PDT) In-Reply-To: References: <8B7FEE2E-500E-49CF-AC5E-A2FA3054B152@gmail.com> <55EF4B65.8030905@delphij.net> From: Igor Mozolevsky Date: Tue, 8 Sep 2015 23:09:35 +0100 X-Google-Sender-Auth: DiYLXlBEraPBdBaC1Xz7PLIOxrY Message-ID: Subject: Re: Passphraseless Disk Encryption Options? To: Analysiser Cc: Xin LI , Hackers freeBSD Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable X-Content-Filtered-By: Mailman/MimeDel 2.1.20 X-BeenThere: freebsd-hackers@freebsd.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: Technical Discussions relating to FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 08 Sep 2015 22:10:16 -0000 On 8 September 2015 at 22:50, Analysiser wrote: > Hi all, > > Thank you so much for all the insights here! I think I is my bad not to > clarify the situation very well but still I found a lot of things I could > try from the replies. In my case I could not do remote passphrase and and > USB boot and/or USB hold key/passphrase since the device might not always > have internet access and no ports (internally or externally are exposed). > > I think your suggestions in separating the root filesystem and user space > applications and data and perform encryption only on user portion is a mo= re > reasonable practice given the time scale on the project I=E2=80=99m worki= ng on. > Thanks again! > > I still have some more detailed questions I=E2=80=99m seeking for an answ= er > related to the full startup disk encryption: I think you're worrying about the problem from the wrong end- what is it that you're attempting to protect, I'm still unsure of that?.. --=20 Igor M.