PEFS encryption for OpenBSD

[mfaridi]

I find good link in bsdnow.tv about PEFS in FreeBSD
Can we have something like this in OpenBSD ?

[Oko]

Where is the link?

which stands for Private Encrypted File System, is a kernel-level stacked cryptographic filesystem for FreeBSD

The answer to your question is obviously you can't use PEFS on OpenBSD. However OpenBSD cryptographic stuck is more potent IMHO than FreeBSD. On the kernel level you have softraid which can be used for the full disk encryption. OpenBSD kernel still includes vnd (vnode disk driver) which also can be used for encryption but it is obsoleted by softraid for full disk encryption. For user-land level encryption I recommend scrypt which is coincidently developed by probably the smartest person in FreeBSD camp and their former chief security officer Collin Parceval. Collin is Canadian holding PhD in mathematics (number theory) from Oxford University and he is top notch mathematician.

[mfaridi]

http://www.bsdnow.tv/tutorials/pefs

[jggimi]

In your other thread this week about disk encryption, you stated that full disk encryption ("FDE") was required. With a little bit of basic research I helped you to discover that both OpenBSD's softraid and FreeBSD's GELI used the same cryptographic primitives, though there are implementation differences and there are operational considerations when choosing between them.

Now, you are asking specifically about a less-than-FDE FreeBSD crytographic tool, and whether it can be deployed on OpenBSD. No, not without being ported.

Perhaps, if your needs have changed, or, you have a new use-case, you might possibly be interested in non-FDE disk encryption methods on OpenBSD? If so, you can use the same tools discussed in your other thread: the softraid CRYPTO discipline can be applied to a single filesystem, such as /home, as I mentioned to you in your other thread. In addition, I'd mentioned vnconfig/mount_vnd, which can create and mount virtual filesystems, and these can be encrypted. While this option cannot be used for FDE, it may be more flexible than softraid for your use-case. This is because the "backing storage" can be partitions as with softraid, but unlike softraid the backing storage can also be a file in a standard filesystem. While this isn't FreeBSD's PEFS implementation, it may have enough similarities that it meets your needs. If it doesn't, then perhaps FreeBSD with PEFS is a better fit solution for your new use-case.