Proposed Change: Self-Encrypting Drive Support In Fedora 41 Anaconda Installer

Fedora 41 Anaconda Installer to Gain Optional Self-Encrypting Drive Support

A proposal by three Red Hat engineers seeks to enhance Fedora Linux 41's disk encryption capabilities by adding optional support for native hardware encryption on TCG OPAL2 compliant drives during installation. This new self-encrypting drive (SED) support, only affecting fresh installations, leverages the hardware encryption features of compatible drives.

Understanding Self-Encrypting Drives and OPAL2

SEDs handle encryption and decryption at the hardware level. The Trusted Computing Group's (TCG) OPAL2 standard defines security features for storage devices, including self-encryption. The proposal focuses on OPAL2-compliant drives; while all OPAL2 drives are SEDs, not all SEDs adhere to OPAL2.

Installation Options

The proposed change introduces two new options for encrypted storage setup within the Anaconda installer:

1. Hardware encryption only: Utilizing the drive's built-in encryption.
2. Combined hardware and software encryption: A layered approach for enhanced security.

Implementation Details

This functionality will be accessible via the kickstart interface, using the --luks-version option:

• --luks-version=luks2-hw-opal: Hardware encryption only.
• --luks-version=luks2-hw-opal-crypt: Combined hardware and software encryption.

The feature won't be enabled by default; users must explicitly select it. Verification post-installation uses sudo cryptsetup luksDump <device></device>, examining the "Data segments" section for hw-opal, hw-opal-crypt, or crypt to confirm the encryption method.

Benefits and Considerations

Potential benefits include improved performance on resource-constrained systems and increased security with layered encryption. However, it's crucial to note that this is an optional feature, requiring user selection and relying on the drive manufacturer's implementation.

Compatibility and Upgrades

This change only affects new installations; existing systems remain unaffected. Post-installation, the user experience should be seamless, mirroring standard disk encryption.

Next Steps

The Fedora Engineering Steering Committee will review the proposal. Approval would expand Fedora 41's encryption options, potentially boosting security and performance for users with compatible hardware. Further details and feedback channels are available on the Fedora discussion forum (link omitted for brevity, but implied in the original text).

The above is the detailed content of Proposed Change: Self-Encrypting Drive Support In Fedora 41 Anaconda Installer. For more information, please follow other related articles on the PHP Chinese website!