RFC: kernel level cryptographic filesystem (summer of code project)

[Gleb Kurtsou]

Hi,

During Google Summer of Code this year I was working on kernel level
cryptographic filesystem pefs. It looks like the project is mature
enough to ask for a public review and comments.

I'm using it to encrypt my mailbox for some time already without any
issues.  For testing I use mostly dbench and fsx tools.

Some of pefs features (comparing to other stacked filesystems):
* Kernel level implementation (no fuse and similar stuff)
* Random per file tweak value used for encryption
* Saves metadata only in encrypted file name (doesn't change file
  content)
* Doesn't change encrypted file size
* Arbitrary number of keys
* Mixing files encrypted with different keys in single directory
* Transparent mode of operation (no encryption, read-only, allows
  accessing filesystem snapshots easily)
* Key chaining (though user level utility)
* Modern encryption algorithms (AES and Camellia in CTR mode, Salsa20)

I've tested it on top of ZFS, UFS and tmpfs (it fails on msdosfs).
I use amd64 9-CURRENT but it should work on 8- and 7-STABLE (+ i386).

For more information, there are several post on my blog regarding pefs:
Step-by-step tutorial: http://blogs.freebsdish.org/gleb/2009/10/01/pefs-encrypting-directory/
Description of cryptographic primitives used: http://blogs.freebsdish.org/gleb/2009/09/23/pefs-crypto-primitives/
And a small benchmark: http://blogs.freebsdish.org/gleb/2009/09/16/pefs-benchmark/

I'd appreciate any feedback and testing.

Short instructions on how to start with it:

1. Download tarball: http://www.2shared.com/file/8154727/3dc45b66/pefs-2009-10-01tar.html

2. Unpack into /usr/src

3. Compile and install:
# make -C /usr/src/sys/modules/salsa20 obj all install clean
# make -C /usr/src/sys/modules/pefs obj all install clean
# make -C /usr/src/sbin/pefs obj all install clean
It installs 2 modules (pefs, salsa20) and user level configuration
utility /sbin/pefs (and /sbin/mount_pefs which is link to /sbin/pefs)

4. Mount pefs filesystem:
% pefs mount ~/Private ~/Private

5. Set your passphrase:
% pefs addkey ~/Private

6. Test it

Thanks,
Gleb.