4 ms·

Isn't encryption supposed to be a separate layer from the filesystem? Or is the merger specific to Windows? Or, is this ZFS' attitude toward features, like with

by aasasd 7y ago

Isn't encryption supposed to be a separate layer from the filesystem? Or is the merger specific to Windows? Or, is this ZFS' attitude toward features, like with the volume manager?

cyphar 7y ago
ZFS "native encryption" is an upstream feature. The argument for doing it in the filesystem rather than as a separate layer is that it allows you to have far more flexibility than classic FDE (encrypted send/recv, you can use different keys for each filesystem, the encryption applies to all data written by ZFS so you don't need to worry about forgetting to set up LUKS on a new drive added to your pool, etc.)
e12e 7y ago
In addition to what @cyphar mentions - zfs is "storage manager". Disk, volume and filesystem. Some of the power and data guarantees relate to this design decision. Encrypted /home/username filesystem with user-owned keys, is one neat trick,for example.
pm7 7y ago
> How many drives can you fit into a laptop? Why? One more addition to other replies: ZFS needs access to disks for self-healing (bit-rot detection and repair). It means that in the past if we wanted encryption, same date needed to be encrypted twice (one for every mirror). Now with encryption in ZFS, date is encrypted before creating redundancy. We can even do a scrub without encryption key.
kop316 7y ago
That is how Linux and FreeBSD handle it. They both present a block layer device that you can then put ZFS on. The ZFS specific encryption IIRC is owned by Oracle, and they do not open source it.
- e12e 7y ago
  Oracle "closed" (forked) zfs "back" and added encryption. But encryption is (now) in openzfs (who's canonical upstream has gravitated to "zfsonlinux" which is just the open project that ended up having the major mind-share). https://github.com/zfsonlinux/zfs/releases/tag/zfs-0.8.0 https://github.com/zfsonlinux/zfs/releases/tag/zfs-0.8.0

by aasasd 7y ago

Isn't encryption supposed to be a separate layer from the filesystem? Or is the merger specific to Windows? Or, is this ZFS' attitude toward features, like with the volume manager?

cyphar 7y ago

ZFS "native encryption" is an upstream feature. The argument for doing it in the filesystem rather than as a separate layer is that it allows you to have far more flexibility than classic FDE (encrypted send/recv, you can use different keys for each filesystem, the encryption applies to all data written by ZFS so you don't need to worry about forgetting to set up LUKS on a new drive added to your pool, etc.)

e12e 7y ago

In addition to what @cyphar mentions - zfs is "storage manager". Disk, volume and filesystem. Some of the power and data guarantees relate to this design decision. Encrypted /home/username filesystem with user-owned keys, is one neat trick,for example.

pm7 7y ago

> How many drives can you fit into a laptop? Why? One more addition to other replies: ZFS needs access to disks for self-healing (bit-rot detection and repair). It means that in the past if we wanted encryption, same date needed to be encrypted twice (one for every mirror). Now with encryption in ZFS, date is encrypted before creating redundancy. We can even do a scrub without encryption key.

kop316 7y ago

That is how Linux and FreeBSD handle it. They both present a block layer device that you can then put ZFS on. The ZFS specific encryption IIRC is owned by Oracle, and they do not open source it.

e12e 7y ago
Oracle "closed" (forked) zfs "back" and added encryption. But encryption is (now) in openzfs (who's canonical upstream has gravitated to "zfsonlinux" which is just the open project that ended up having the major mind-share). https://github.com/zfsonlinux/zfs/releases/tag/zfs-0.8.0 https://github.com/zfsonlinux/zfs/releases/tag/zfs-0.8.0