Bug 1406805

Summary: RFE: enable use of LUKS in combination with qcow2.
Product: Red Hat Enterprise Linux 7 Reporter: Daniel Berrangé <berrange>
Component: libvirtAssignee: Peter Krempa <pkrempa>
Status: CLOSED WONTFIX QA Contact: yisun
Severity: unspecified Docs Contact: Jiri Herrmann <jherrman>
Priority: high    
Version: 7.4CC: brault, coli, dyuan, eblake, eharney, hpopal, jliberma, jsuchane, kchamart, lmen, lmiksik, michen, mtessun, pgrist, timao, xuzhang
Target Milestone: rcKeywords: FutureFeature
Target Release: 7.4   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
: 1518999 (view as bug list) Environment:
Last Closed: 2019-04-09 12:17:26 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 760547, 1406803    
Bug Blocks: 1500889, 1500891, 1518999, 1636224    

Description Daniel Berrangé 2016-12-21 14:20:22 UTC 
Description of problem:
While there is a generic LUKS driver for QEMU that can be layered above or below any block backend, neither of these options are desirable in combination with QCow2.

If layered below qcow2, both the header & payload are encrypted making it impossible to query basic info about the qcow2 volume (eg its size) without decrypting it first.

If layered above qcow2, the payload is encrypted using virtual disk sector numbers as the input for initialization vectors. This is insecure when combined with qcow2 internal snapshots, since data in each snapshot will use the same initialization vector for any given guest sector.

Thus qemu will provide native integration of LUKS & qcow2. Libvirt needs to be able to enable this feature.

Version-Release number of selected component (if applicable):
libvirt-2.0.0-10.el7
Comment 10 Jaroslav Suchanek 2019-04-09 12:17:26 UTC 
This feature will be finished in the next major release of RHEL.