1.\" $NetBSD: cgd.4,v 1.10 2008/04/30 13:10:53 martin Exp $ 2.\" 3.\" Copyright (c) 2002, 2003 The NetBSD Foundation, Inc. 4.\" All rights reserved. 5.\" 6.\" This code is derived from software contributed to The NetBSD Foundation 7.\" by Roland C. Dowdeswell. 8.\" 9.\" Redistribution and use in source and binary forms, with or without 10.\" modification, are permitted provided that the following conditions 11.\" are met: 12.\" 1. Redistributions of source code must retain the above copyright 13.\" notice, this list of conditions and the following disclaimer. 14.\" 2. Redistributions in binary form must reproduce the above copyright 15.\" notice, this list of conditions and the following disclaimer in the 16.\" documentation and/or other materials provided with the distribution. 17.\" 18.\" THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 19.\" ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 20.\" TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 21.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 22.\" BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 23.\" CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 24.\" SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 25.\" INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 26.\" CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 27.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 28.\" POSSIBILITY OF SUCH DAMAGE. 29.\" 30.Dd March 11, 2006 31.Dt CGD 4 32.Os 33.Sh NAME 34.Nm cgd 35.Nd cryptographic disk driver 36.Sh SYNOPSIS 37.Cd "pseudo-device cgd" Op Ar count 38.Sh DESCRIPTION 39The 40.Nm 41driver provides the capability of encrypting blocks on their way 42to and from a disk or partition. 43.Pp 44In order to compile support for the 45.Nm 46into your kernel, you must add the driver to your kernel configuration 47file. 48To do this, add a line similar to: 49.Bd -unfilled -offset indent 50pseudo-device cgd 4 # cryptographic disk driver 51.Ed 52.Pp 53The count argument defines how many 54.Nm Ns 's 55may be configured at a time. 56.Ss Encryption Algorithms 57Currently the following cryptographic algorithms are supported: 58.Bl -tag -width indentxxxxxxx 59.It aes-cbc 60AES in CBC mode. 61AES uses a 128 bit blocksize and can accept keys of 62length 128, 192, or 256. 63The default key length is 128. 64.It 3des-cbc 65Triple DES in CBC mode. 66Triple DES uses a 64 bit blocksize and is 67performed in EDE3 mode with a 168 bit key. 68The key passed to the kernel 69is 192 bits but the parity bits are ignored. 70.It blowfish-cbc 71Blowfish in CBC mode. 72Blowfish uses a 64 bit blocksize and can accept keys between 40 and 73448 bits in multiples of 8. 74It is strongly encouraged that keys be at least 128 bits long. 75There are no performance advantages of using shorter keys. 76The default key length is 128 bits. 77.El 78.Ss IV Methods 79Currently, the only IV Method supported is 80.Ar encblkno 81(Encrypted Block Number). 82This method encrypts the block number of the 83physical disk block with the cipher and key provided and uses that as the 84IV for CBC mode. 85This method should ensure that each block has a different 86IV and that the IV is reasonably unpredictable. 87.Ss IOCTLS 88A 89.Nm 90responds to all of the standard disk 91.Xr ioctl 2 92calls defined in 93.Xr sd 4 , 94and also defines the following: 95.Bl -tag -width CGDIOCSET 96.It CGDIOCSET 97configure the 98.Nm . 99This 100.Xr ioctl 2 101sets up the encryption parameters and points the 102.Nm 103at the underlying disk. 104.It CGDIOCCLR 105unconfigures the 106.Nm . 107.El 108.Pp 109These 110.Xr ioctl 2 Ns 's 111and their associated data structures are defined in 112.Pa /usr/include/dev/cgdvar.h . 113.Sh WARNINGS 114It goes without saying that if you forget the passphrase that you used 115to configure a 116.Nm , 117then you have irrevocably lost all of the data on the disk. 118Please ensure that you are using an appropriate backup strategy. 119.Sh FILES 120.Bl -tag -width indentxxxxxxxxxxx 121.It /dev/{,r}cgd* 122.Nm 123device special files. 124.El 125.Sh SEE ALSO 126.Xr config 1 , 127.Xr ioctl 2 , 128.Xr sd 4 , 129.Xr MAKEDEV 8 , 130.Xr cgdconfig 8 131.Sh HISTORY 132The 133.Nm 134driver was written by Roland C. Dowdeswell for 135.Nx . 136The 137.Nm 138driver originally appeared in 139.Nx 2.0 . 140