How to en/decrypt an fs image before copying to a ramdisk?

[Sadako]

I'm playing with a custom livecd that will copy the filesystem image to ram and boot from there, but I want the image to be encrypted on the livecd and decrypted before or as it is copied to the ramdisk, and was wondering what the best way to do this is?

I was originally thinking dmcrypt/cryptsetup, but I don't think that would make a whole lot of sense in this case.

Something like aespipe looks suitable, but I just wanted to get the opinions of others first, so any other ideas?

(also, the latest aespipe in portage is over two years old, which gives me some concerns...)

Thanks.
_________________
"You have to invite me in"

[richard.scott]

I've seen threads about this support in Catalyst:

http://www.nabble.com/Encrypted-livecd's---need-testers-td11341634.html

I'm not sure what's come of it tho.

In theory, if catalyst can do it, then anyone can!

[Sadako]

richard.scott: Thanks for that link, I had already dismissed using cryptsetup as that would require using losetup as well, but it gave me another idea;

Rather than storing the squashfs image on the iso filesystem itself, I could simply append it to the end of the iso image, and I could even add extra random data before and after the squashfs, too.
Then I could use cryptsetup with an offset on the cd device itself (eliminating the need for losetup), and use dd to copy from the decrypted dev map to a ram disk.

Of course, I realise all this is just extra security by obscurity, and any idiot could figure it out by looking at my linuxrc anyways, but this just has a certian perverse appeal to me, so I think I'll give it a shot.

I really don't understand why the guy creating that livecd is using the luks extensions, though.

Anyways, thanks again for the link, it gave me some interesting ideas.
_________________
"You have to invite me in"

[richard.scott]

I can sort of understand why he's wanting to encrypt the RootFS on a CD as I'm wanting to do the same
It'd stop people reverse engineering your hard work if you use this as a platform for a project.

Would it be possible to put the RootFS in an encrypted image inside SquashFS and then mount that as your root?.... rather than placing it in a random place on the CD as it would save the effort of working that out?

You could also easily copy the iso contents onto a usb stick too and boot from that if you wanted!

[Sadako]

[richard.scott]

I'd forgotten that copying the image to ram before encrypting it would use up memory! doh!