Some encryption-related projects

[W. Michael Petullo]

I have several encryption-related projects that I like to advertise
on this list every once in a while in hopes of attracting interested
developers or testers.  Since we are just beginning work on Fedora Core
4, now seemed like a good time to mention them.

1.  Encrypted swap.

This is a prerequisite for many different disk encryption techniques.
See [1] for a good example of why this is necessary (potential shortcoming
of Apple's FileVault).  See Red Hat bug #127378 for some discussion about
this, including a proposed patch for initscripts.  The patch has not been
scrutinized very much yet, so is only meant to encourage discussion at
this point.

2.  Encrypted root filesystem.

Red Hat Bug #182479 discusses adding support for an encrypted root
filesystem to Fedora.  The bug contains a patch for mkinird that
facilitates this.  Eventually it would be nice to see support in anaconda
for this, but #182479 is the first step.

3.  Pam-keyring.

The pam-keyring PAM module unlocks a GNOME keyring for a user using that
user's login password.  The idea behind pam-keyring is to make using
GNOME keyrings as transparent as possible.  Pam-keyring is available
at http://flyn.org/projects/pam_keyring/index.html.

4.  Command line gnome-keyring tool.

GNOME bug #155681 proposes an addition to gnome-keyring.  The
gnome-keyringtool utility is a program that manipulates keyrings from
the command line.  I originally wrote gnome-keyringtool so that it could
be assigned SELinux privileges and used by pam-keyring.  This avoids
assigning additional privileges to various login programs.

5.  Automounting encrypted removable filesystems.

I would like to see encrypted removable filesystems handled as
transparently as other removable media.  Red Hat bug #133461
discusses this a bit.  I have done some experimentation with
this and have a prototype working.  However, my work contains
a large kludge to get HAL to acknowledge dm-crypt filesystems
properly.  Documentation of this shortcoming may be found at
http://freedesktop.org/pipermail/hal/2004-September/001051.html and
http://marc.theaimsgroup.com/?l=linux-kernel&m=109937418210973&w=2.

[1] Archive of bugtraq mailing list message:
http://securityfocus.com/archive/1/367116/2004-06-24/2004-06-30/0
Date: 06/25/2004
Subject: Mac OS X stores login/Keychain/FileVault passwords on disk
Author: Matt Johnston

-- 
Mike

:wq