gbde and geli - differences

[Roland Smith]

On Tue, Mar 20, 2007 at 10:36:19PM +0000, RW wrote:
> On Tue, 20 Mar 2007 19:06:28 +0100 (CET)
> Wojciech Puchar <wojtek at tensor.gdynia.pl> wrote:
> 
> > what they are. both works, both works right.
> > geli has more options.
> > 
> > why there are both? what should i use to have better chance i will be
> > able to recover data after say 10 years knowing password?
>  
> I presume it's to do with geli using OpenSSL libraries and so picking-up
> hardware acceleration where available. I think gdbe is being sidelined.

geli uses the crypto(9) framework. Not sure about the OpenSSL libraries.

> > i need both encrypted partition and encrypted copies/DVDs.
> 
> I'd be interested if anyone has a method for creating encrypted DVDs
> that still works. 

You can use a UFS filesystem on a DVD. In short:
- create an file with random characters the size of a DVD.
- use that as a vnode backed memory disk with mdconfig.
- initialize and attach that with geli.
- create a new filesystem on the geli device
- mount it.

E.g:

# dd if=/dev/random of=$HOME/backupDVD.img bs=1m count=4000
# mdconfig -a -t vnode -f $HOME/backupDVD.img
(The name of the md device will be printed on stdout, e.g. 'md0'.)
# geli init -l 256 /dev/md0
# geli attach /dev/md0
# newfs /dev/md0.eli
# mount /dev/md0.eli /mnt/root

Use it. Then:

# umount /mnt/root
# geli detach md0.eli
# mdconfig -d -u 0

Roland
-- 
R.F.Smith                                   http://www.xs4all.nl/~rsmith/
[plain text _non-HTML_ PGP/GnuPG encrypted/signed email much appreciated]
pgp: 1A2B 477F 9970 BA3C 2914  B7CE 1277 EFB0 C321 A725 (KeyID: C321A725)
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 187 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-questions/attachments/20070320/8e0e7ed4/attachment.pgp