HP UX Encrypted Volume and Filesystem (EVFS) manual How Evfs Uses Keys

How EVFS Uses Keys

EVFS uses symmetric volume encryption keys to encrypt the volume data. EVFS also uses public/private keys to encrypt the volume encryption keys, and it uses passphrases to encrypt private keys, as follows:

•The volume encryption key is stored in key records, or digital envelopes, in the EMD area of the EVFS volume. Each key record contains the volume encryption key, encrypted by a user's public key.

•User's public keys are stored in a local database, unencrypted.

•User's private keys are stored in a local database. Each private key is encrypted with a passphrase.

•As an option, a passphrase can be stored in a file, encrypted with system-specific data. A stored passphrase is a security risk. However, it enables you to execute some EVFS commands without entering a passphrase and to use the EVFS autostart feature.

Creating an EVFS Volume

When you create an EVFS volume and the EMD, the following sequence of events occurs:

1.The user enters the evfsvol create command and specifies a key pair name for the owner key. The evfsvol utility prompts the user for the passphrase for the users's private key. When creating a new EVFS volume, evfsvol always prompts the user for passphrase. (Other evfsvol subcommands, such as evfsvol enable, allow you to use stored passphrases.)

2.The evfsvol utility reads operating parameters from the /etc/evfs/evfs.conf file, such as the data encryption algorithm for the volume, and writes them to the EMD.

3.The evfsvol utility generates the volume encryption key.

4.The evfsvol utility creates a key record for the owner by encrypting the volume encryption key with the owner's public key (which creates a digital envelope). The evfsvol utility writes this key record to the EMD.

Enabling an EVFS Volume

To enable encryption and decryption for an EVFS volume, the following sequence of events occurs:

1.The user enters the evfsvol enable command. The evfsvol utility prompts the user for the passphrase for the user's private key. The user enters the passphrase.

Alternatively, EVFS retrieves the user's passphrase from a file. In this case, the passphrase is encrypted with system-specific data, and EVFS decrypts the passphrase before using it.

2.EVFS uses the passphrase to decrypt the user's private key.

3.EVFS uses the user's private key to decrypt the key record (EVFS “opens” the key record's digital envelope) and extracts the volume encryption key from the key record.

4.EVFS uses the volume encryption key to encrypt and decrypt the EVFS volume data as needed.

Figure 1-3illustrates how EVFS uses keys to enable an EVFS volume.

22 EVFS Introduction