ZFS Native Encryption by Tom Caputi

…cek wrote a nice post about it: link and I quote: "If you’re encrypting a filesystem and not disk blocks, still don’t use XTS! Filesystems have format-awareness and flexibility. Filesystems can do a much better job of encrypting a disk than simulated hardware encryption can." Edit: check out this presentation on how encryption was bolted on ZFS: link to this video (slides: link ) It's not perfect, but it provides data authentication by reusing checksum fields for storing MACs. Edit 2: also check out bcachefs encryption design doc: link (also not perfect, but uses proper AEAD — ChaCha20-Poly1305. I sent some questions and suggestions to the author, but received no reply :/)…

The problem is that a stream cipher is going to have some per-object uniqueness (a salt, IV, etc.), so by design even if you feed it related input blocks you will get different output blocks. This is, of course, antithetical to deduplication: so you need to check/store the hash of the input before it goes through the cipher. The presentation about ZFS' native encryption1 covers many of these sorts of trade-offs necessary to do full-disk encryption at scale. 1: link to this video

This is still geli+zfs, and not native zfs encryption that was recently presented in OpenZFS Developer Summit 0. 0 link to this video

Native ZFS encryption may become available soon. It is pending code review: link There was a presentation of this by Tom Caputi at the most recent OpenZFS Developer Summit. Slides: link Video: link to this video Conference: link

I work with Tom at Datto. He presented all of his design decisions at the OpenZFS developer conference here: link Slides: link Video: link to this video