On Wed, Sep 17, 2025 at 01:42:59AM +0200, Jeremie Courreges-Anglas wrote:
> On Wed, Sep 17, 2025 at 09:29:12AM +1000, Damien Miller wrote:
> > On Wed, 17 Sep 2025, Jeremie Courreges-Anglas wrote:
> > 
> > > Should vnconfig move from blowfish, it should probably be to a scheme
> > > actually designed for data storage like AES-XTS (like softraid CRYPTO)
> > > or similar.
> > > 
> > >   https://en.wikipedia.org/wiki/Disk_encryption_theory
> > > 
> > > I'm no crypto expert, but I doubt that moving from blowfish-CBC to
> > > AES-CBC would be a big win.
> > 
> > softraid already uses AES-XTS for encrypted volumes.
> 
> Yup.
> 
> > IMO vnconfig
> > crypto is just legacy and should be removed.
> 
> From looking at the code, vnconfig already says:
> 
>   WARNING: Consider using softraid crypto.
> 
> Maybe we should make it clear that we're going to remove this code,
> say, for 7.9?  If people actually wanted to keep using this, I guess
> someone would have stepped up by now.

Surely it's more likely that anyone who is already using it would just ignore
the warning and assume that it's aimed at new users?  Exactly because there is
no mention of the vnconfig encryption support being removed.

Why not start by making the related options undocumented in the manual?

--- vnconfig.8	Mon Apr  7 04:25:03 2025
+++ vnconfig.8	Wed Sep 17 12:37:57 2025
@@ -58,10 +58,6 @@
 .Sh SYNOPSIS
 .Nm vnconfig
 .Op Fl v
-.Oo
-.Fl k | K Ar rounds
-.Op Fl S Ar saltfile
-.Oc
 .Op Fl t Ar disktype
 .Op Ar vnd_dev
 .Ar image
@@ -89,36 +85,11 @@
 .Pp
 The options are as follows:
 .Bl -tag -width Ds
-.It Fl K Ar rounds
-Associate an encryption key with the device.
-All data will be encrypted using the Blowfish cipher before it is
-written to the disk.
-The user is asked for both a passphrase and the name of a salt file.
-The salt file can also be specified on the command line using the
-.Fl S
-option.
-The passphrase and salt are combined according to PKCS #5 PBKDF2 for the
-specified number of
-rounds to generate the actual key used.
-.Ar rounds
-is a number between 1000 and
-.Dv INT_MAX .
-DO NOT LOSE THE SALT FILE.
-.It Fl k
-Associate an encryption key with the device.
-The user is asked for the encryption key.
-All data will be encrypted using the Blowfish cipher before it is
-written to the disk.
 .It Fl l
 List the vnd devices and indicate which ones are in use.
 If a specific
 .Ar vnd_dev
 is given, then only that one will be described.
-.It Fl S Ar saltfile
-When
-.Fl K
-is used, specify the
-.Pa saltfile .
 .It Fl t Ar disktype
 Specify a
 .Ar disktype
@@ -149,19 +120,6 @@
 # vnconfig vnd0 /tmp/diskimage
 # mount -t cd9660 /dev/vnd0c /mnt
 .Ed
-.Pp
-Configure an encrypted image file as vnode disk vnd0 and mount the FFS
-file system contained in the
-.Sq a
-partition of the disklabel.
-Same as above, but now configure the vnode using PKCS #5 PBKDF2 and
-a salt file with 20000 rounds:
-.Bd -literal -offset indent
-# vnconfig -K 20000 vnd0 /tmp/cryptimg
-Encryption key:
-Salt file: /tmp/cryptsalt
-# mount /dev/vnd0a /mnt
-.Ed
 .Sh SEE ALSO
 .Xr vnd 4 ,
 .Xr disktab 5 ,
@@ -174,3 +132,10 @@
 .Nm
 command first appeared in
 .Ox 4.2 .
+.Pp
+This version of
+.Nm vnconfig
+includes support for handling encrypted images.
+The options used for this are intentionally not documented here, as support
+for them will be removed in a future release.  Users are encouraged to use the
+softraid crypto discipline for equivalent functionality.