hesela.devInline encryption
Inline encryption is per-I/O encryption in the storage path, controlled by a key, algorithm, data-unit size and data-unit number.
Linux v6.12 carries an encryption context with block I/O and manages hardware capabilities and keyslots. Unlike a memory crypto accelerator, the hardware processes storage requests; unlike a self-encrypting drive, it exposes per-request cryptographic control. [1]
The optional blk-crypto-fallback backend uses the kernel crypto API. For identical input and encryption parameters, correct implementations produce the same on-disk ciphertext, so the execution backend is distinct from the file format. [1]
The documented lifecycle separates completion, eviction and zeroization. Only after all I/O completes should a caller evict the key from each block device using it, then zeroize the key object. Releasing a request's keyslot reference is not the entire lifecycle. [1]
Relations
- related
- fscrypt, Self-encrypting drive (SED), UFS (Universal Flash Storage), XTS-AES, Cryptographic erase
Limitations
- Support through blk-crypto does not itself prove hardware offload or authenticated encryption. [1, 2]
Citations
- Linux v6.12: inline encryption, block-I/O contexts and software fallback
- Linux v6.12: fscrypt, encryption modes and inline encryption support