Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I think btrfs subvolumes can do this? However btrfs doesn't (yet?) support encryption.


I am using BTRFS and FDE encryption right now on Fedora Silverblue for a year if not more.

And like the post says, I am typing two passwords.


I'm talking about filesystem level support, not block level support. FDE is block level and of course will work on any supported filesystem including btrfs.

What btrfs doesn't do is support encryption inside the filesystem a la fscrypt - where we can encrypt specific directories - or ZFS encryption, where we can encrypt specific filesystems inside a pool.

If I understand btrfs right, supporting encryption/verification on subvolume or directory levels would allow splitting the system so only part of it is encrypted/verified (so we get Poettering's performance gains), while avoiding space issues between the subvolumes.

Also, using only one password is easy on fscrypt style systems, though this may not suit everyone's threat model.


fscrypt support for btrfs is apparently under development; see the most recent comments at https://github.com/btrfs/btrfs-todo/issues/25




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: