0

I'm designing an industrial embedded system which needs some encryption. I know encryption will slow things down quite a bit since my media will be either compact flash or SD. I really only need to encrypt certain files in /etc, maybe some application specific log files, and data files.

Can I just create hard links to all the folders and files that need to be encrypted, locate them on a separate volume, and encrypt this volume? Would this be transparent to the networking stack if I encrypted the networking files that have the wpa2 passkeys in them? Or is there a way to transparently encrypt certain files in place?

  • Where are you going to store the encryption key? Encrypting is useless if the key is stored next to the encrypted data. Unless you want to enter the key every time the device boots (that's what people do on workstations, but it's generally not applicable to embedded devices) or you have tamper-resistant hardware (do you?), you cannot keep the data confidential. – Gilles Jun 18 '16 at 20:15
  • Hmmm good point. This is just feature/trade-off study at this point so I can make recommendations to my manager to make recommendations to the client. The devices themselves will be physically secure and on a secure, possibly encrypted subnet with only ssh access which might make device level encryption redundant. – dpetican Jun 19 '16 at 1:59
1

You cannot hard link across file system boundaries.

In the case of configuration files, symbolic links would be transparent to the application. For some other cases, you may need to symbolic link the containing folder.

Files like wpa_supplicant.conf can use hashed passwords (although this might still not be sufficiently secure for your application).

Encryption is usually of either entire block devices (eg dm-crypt), or as a stacked filesystem (eg eCryptfs). The latter are a little less secure, because they can leak metadata. You will still have to deal with the problem of securely mounting your encrypted filesystem on startup.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.