Linked by Thom Holwerda on Mon 15th Nov 2010 23:37 UTC, submitted by comay
Thread beginning with comment 450106
To view parent comment, click here.
To read all comments associated with this story, please click here.
To view parent comment, click here.
To read all comments associated with this story, please click here.
Opensolaris had gotten support for the onboard AES encryption in recent Intel chips (Nehalem die-shrink: Westmere) so if you have a laptop with one of the newer i5/i7 you'll get better performance for ZFS crypto if using AES.
Darren Moffat has two good blog posts up about ZFS-Crypto (he was project lead). Obviously posted them to tie in with this release.
http://blogs.sun.com/darren/
Agreed. And for me, I really want be able to encrypt a disk partition. ZFS crypto is a /big/ feature.
ZFS crypto will not help with encrypting a single disk partition, as it works at the filesystem layer, not the disk layer. Unless you are going to make a pool using just that one partition, but then you lose all the benefits of running ZFS as you have 0 redundancy.
There are other options to encryption, even with ZFS; at least in the FreeBSD world, thanks to GEOM. Use geli(4) to create encrypted GEOM providers, then build your ZFS pool out of those providers. Voila! Encrypted ZFS pool. Sure, it's pool-level and not ZFS filesystem level, but it's still encrypted.
In ZFS it is extremely easy and quick to a new filesystem. Filesystems are extremely light weight, like an ordinary directory.
# zfs create myZPOOL/thisIsAFilesystem
which takes less than one second.
In other words, it is no problem that "only" filesystems are encrypted. You should only store data in filesystems anyway.




Member since:
2005-07-06
Agreed. And for me, I really want be able to encrypt a disk partition. ZFS crypto is a /big/ feature.