Understanding How Encryption Works

[wave2453]

Hello,
I figured this was a different kind of question about the encryption so I should create a new post.

I am trying to figure out how the encryption works and how I can prove it works. As I explained in my other post I am looking to put PHI data on my FreeNAS 11.1 U4 system and it will be audited by external auditors.

I am looking to find out how key management is handled and how can i prove that. I am specifically looking for the following

-Where is the data encrypting key stored?
-is the data encrypting key protected with a key encrypting key and if so where is it stored?
-Is there a command, documentation or config file that shows the above to be true?

Thank You!

 

[kdragon75]

HIPAA does not require data encryption at rest but I would still strongly recommend doing so. Please review the official FreeNAS documentation regarding encryption for some important and useful information. If that does not answer your questions, please feel free to let us know what you still need.

 

[wave2453]

Thanks for your response kdragon.

I am not talking about HIPAA I am referring to the PCI standard I should have more clearly specified that in my initial response so I apologize for that. I have also reviewed the documentation you pointed me to. This document is great for setting up encryption but does a poor job of describing what the encryption is doing or how the keys are managed.

What I am looking for is.

-Where is the data encrypting key stored?
-is the data encrypting key protected with a key encrypting key and if so where is it stored?
-Is there a command, documentation or config file that shows the above to be true?

 

[wave2453]

I just found this post.

https://forums.freenas.org/index.php?threads/recover-encryption-key.16593/

Where Dusan essentially killed it with how the encryption works. I think I just need someone to confirm this is still how it works and how I can prove it.

 

[kdragon75]

http://lmgtfy.com/?q=openzfs+encryption

 

[wave2453]

Is ZFS doing the encryption or is geli doing the encryption?

Edit: The reason I ask is because I have a key saved in /data/geli that was created when I encrypted my volume.

Edit2: in the official docs it talks about using GELI https://doc.freenas.org/11/storage.html#encryption

 

[danb35]

http://lmgtfy.com/?q=openzfs+encryption

Being a smartass (which anyone using lmgtfy.com is undeniably doing) only works when you're right, and in this case, you aren't right--OpenZFS encryption isn't used in FreeNAS, and indeed isn't available in FreeBSD at all at this point. @wave2453 is correct that FreeNAS uses geli for encryption.

 

[wave2453]

Thank @danb35 for the clarification. I unfortunately have still not been able to find much about how the key management is handled in FreeNAS.

 

[danb35]

I think that proving it is going to be a matter of "use the source, Luke." And as to "how the key management is handled in FreeNAS", I believe the best answer is "poorly", based on the number of threads here where people with encrypted pools have lost them. But my own smartass-ness aside, I don't believe FreeNAS's use of encryption has changed significantly since the 9.0 days, or maybe even earlier (with the exception of The Release That Must Not Be Named). Thus, if @Dusan's post was correct at the time, it's highly likely it's still correct today.

This really should be documented--suggest you file a bug against the docs that will be ignored for a few years.

 

[wave2453]

Thank you @danb35. I will probably go off of what @Dusan said. I will also file a bug report whether it gets recognized or not is a different matter but at least an issue is logged. I believe the security behind the keys is good it's just no one has taken the time to document it.

Thanks Again!

 

[Ericloewe]

Key management after setup, as I understand it, is that FreeNAS stores the first key, which only works in combination with the password. The recovery key is always managed exclusively by the admin.

 

[wave2453]

Just to add to this post if anyone finds it. With @Dusan giving a good explanantion you can find a lot of key documentation at the GELI page here https://www.freebsd.org/cgi/man.cgi?query=geli&sektion=&n=1 . It doesn't explain it well but you can use this to backup what you know.


Essentially use Dusan's post to understand it and use the documentation to back it up to auditors.