GELI support on /boot folder

[Xin Li]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On 03/18/15 11:50, Pedro Arthur wrote:
> Hi, I was discussing with Kris Moore about adding support for GELI
> in bootloader as a GSoC project, thus the /boot folder could be
> encrypted.

What's the benefit of encrypting /boot?  If it's encrypted, will the
system use only passphrase to unlock the storage, instead of the
combination of both passphrase and a key file?

(Use passphrase only is a bad idea because that would mean we
essentially encrypt different data with the same key, if two encrypted
providers both use the same passphrase.  This is probably not a big
deal for single disk systems like a laptop system but could have bad
consequence if it's used in larger scale).

Cheers,
- -- 
Xin LI <delphij at delphij.net>    https://www.delphij.net/
FreeBSD - The Power to Serve!           Live free or die
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.1.2 (FreeBSD)

iQIcBAEBCgAGBQJVFJ0QAAoJEJW2GBstM+nsiPAP/icF4pbVf5yosxErQKQHd2nm
/0Kf0uurpcYCvQgzU6F4Y1vDonGEZgQV6Iyl0Xq5NgvKWYowp2gl6289/Qndnk0m
QPDSEAfrmkoNSoTUV6KLuV/3q2aBZdZFKSWhQdJLbPHWpqVGrisbqmFmPaNafhoC
1Y62gvaA+u1r+IxGMVTedz7PErA2//jEF1PcnMKM6L5K7m9YIf5L8UgVkqWBXDtR
nc6pDryvdLvm9m+T8b1CN0EYeqYGQrpql0SCZR7GkTfWwev1X/23oZYmCgtUuft8
FIj0loQc9A2jZ0cZ9aYhpAFxiLVJjB19b3cCkEtbc+9U+wcyTo1BayC3G9t8ZI5g
VIx/I9lssZ07onVUu50C70IGbI+tB9Hjo+pA/76RIhzg93JfNpCJ1/Lqfcq3IzqB
UUYgqnPf3+oV+OipmTUfG0/gYsBk5TpYEmAv3wpoatNRNwrofFMAGQLeVvLEGJ2a
5n8v8kZfSPXtI/8WE8EZKEP8iGPYiOHm0vujkVMJStWYwS8H9Z+y1zWGodcnO5Jq
7J+K1776WGWDGVetL3S3Ma+UjtCd9K3y+HJWHjYRhpFJsKi38Ur9o9p5U6F7r5M1
PbGnf6dZNVUAZJYBQgKXMpHbWmCuU9KLXUX1NtCfGqhx4BVXmU7e0/EmPFafbeGm
FD5SwR3r9khIEoNFSgrK
=+O3x
-----END PGP SIGNATURE-----