- cryptographic disk driver
pseudo-device cgd[ count]
driver provides the capability of encrypting blocks on their way
to and from a disk or partition.
In order to compile support for the
into your kernel, you must add the driver to your kernel configuration
To do this, add a line similar to:
pseudo-device cgd 4 # cryptographic disk driver
The count argument defines how many
may be configured at a time.
Currently the following cryptographic algorithms are supported:
Currently, the only IV Method supported is
(Encrypted Block Number).
This method encrypts the block number of the
physical disk block with the cipher and key provided and uses that as the
IV for CBC mode.
This method should ensure that each block has a different
IV and that the IV is reasonably unpredictable.
responds to all of the standard disk
calls defined in
and also defines the following:
AES in CBC mode.
AES uses a 128 bit blocksize and can accept keys of
length 128, 192, or 256.
The default key length is 128.
Triple DES in CBC mode.
Triple DES uses a 64 bit blocksize and is
performed in EDE3 mode with a 168 bit key.
The key passed to the kernel
is 192 bits but the parity bits are ignored.
Blowfish in CBC mode.
Blowfish uses a 64 bit blocksize and can accept keys of length 128.
sets up the encryption parameters and points the
at the underlying disk.
and their associated data structures are defined in
It goes without saying that if you forget the passphrase that you used
to configure a
then you have irrevocably lost all of the data on the disk.
Please ensure that you are using an appropriate backup strategy.
device special files.
driver was written by Roland C. Dowdeswell for
driver originally appeared in