en/decryption above or below FSD ?

NTFSD
1

Hello

I would like to know which method is better (for online en/decryption):
a) filter driver above FSD, or
b) filter driver below FSD.

Thank you.

Igor Rosenberg
xxxxx@taureus.sk

2

We are writing an en/decryption filter driver above FSD
because we need to en/decrypt files specified by users and
we can get file names above FSD to decide whether to do
en/decryption or not.
I think it may be difficult to get file names below FSD.

I hope this helps.

Regards,

Takashi

3

> I would like to know which method is better (for online en/decryption):

a) filter driver above FSD, or
b) filter driver below FSD.

Below is better. Leave the high-level (from the app to the cache) path
intact and do the encryption-decryption on low-level noncached path which
also includes paging.
This is how NTFS/EFS does this on w2k.

The hugest concern for you in such a model is the file size (including the
issues of Cc interaction and FSRTL_COMMON_FCB_HEADER). You will have to
store the original cleartext file size somewhere on the disk.
The variants are:

  • a header appended to the encrypted file (some problems if the header is
    not page-aligned).
  • alternate NTFS stream (incompatible with FAT).
  • some central repository like some file of your own format or the registry.

Max

4

Hello,

in the IFS kit, there is an example Sfilter. In this example, the filter is
attached using \Device\RawDisk.
How can I tell if it is above or below FSD ?

Thank you.

Igor Rosenberg
xxxxx@taureus.sk

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com]On Behalf Of
xxxxx@itg.hitachi.co.jp
Sent: 17. októbra 2000 0:00
To: File Systems Developers
Subject: [ntfsd] Re: en/decryption above or below FSD ?

We are writing an en/decryption filter driver above FSD
because we need to en/decrypt files specified by users and
we can get file names above FSD to decide whether to do
en/decryption or not.
I think it may be difficult to get file names below FSD.

I hope this helps.

Regards,

Takashi

You are currently subscribed to ntfsd as: xxxxx@taureus.sk
To unsubscribe send a blank email to $subst(‘Email.Unsub’)

5

Thank you.

I have one more question (so far). I have IFS kit and there is an example
Sfilter. The filter is attached using \Device\RawDisk. Is it below or above?
How it is about file names below FSD ?

Thank you.

Igor Rosenberg
xxxxx@taureus.sk

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com]On Behalf Of Maxim S. Shatskih
Sent: 17. oktobra 2000 14:54
To: File Systems Developers
Subject: [ntfsd] Re: en/decryption above or below FSD ?

I would like to know which method is better (for online en/decryption):
a) filter driver above FSD, or
b) filter driver below FSD.

Below is better. Leave the high-level (from the app to the cache) path
intact and do the encryption-decryption on low-level noncached path which
also includes paging.
This is how NTFS/EFS does this on w2k.

The hugest concern for you in such a model is the file size (including the
issues of Cc interaction and FSRTL_COMMON_FCB_HEADER). You will have to
store the original cleartext file size somewhere on the disk.
The variants are:

  • a header appended to the encrypted file (some problems if the header is
    not page-aligned).
  • alternate NTFS stream (incompatible with FAT).
  • some central repository like some file of your own format or the registry.

Max

You are currently subscribed to ntfsd as: xxxxx@taureus.sk
To unsubscribe send a blank email to $subst(‘Email.Unsub’)

6

Thank you for your answer.

Please can you tell my if there is any source of information (and source
code) about filter drivers. I have IFS kit, Windows NT device driver book
and File System Internals.

thank you.

Igor Rosenberg
xxxxx@taureus.sk

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com]On Behalf Of Maxim S. Shatskih
Sent: 17. oktobra 2000 14:54
To: File Systems Developers
Subject: [ntfsd] Re: en/decryption above or below FSD ?

I would like to know which method is better (for online en/decryption):
a) filter driver above FSD, or
b) filter driver below FSD.

Below is better. Leave the high-level (from the app to the cache) path
intact and do the encryption-decryption on low-level noncached path which
also includes paging.
This is how NTFS/EFS does this on w2k.

The hugest concern for you in such a model is the file size (including the
issues of Cc interaction and FSRTL_COMMON_FCB_HEADER). You will have to
store the original cleartext file size somewhere on the disk.
The variants are:

  • a header appended to the encrypted file (some problems if the header is
    not page-aligned).
  • alternate NTFS stream (incompatible with FAT).
  • some central repository like some file of your own format or the registry.

Max

You are currently subscribed to ntfsd as: xxxxx@taureus.sk
To unsubscribe send a blank email to $subst(‘Email.Unsub’)

7

> in the IFS kit, there is an example Sfilter. In this example, the filter
is

attached using \Device\RawDisk.
How can I tell if it is above or below FSD ?

It is above the FSD.
BTW - is has a bug with the CDFS recognizer. Try to access an empty CD-ROM
drive immediately after the boot.

Max

8

> Please can you tell my if there is any source of information (and source

code) about filter drivers. I have IFS kit, Windows NT device driver book
and File System Internals.

That’s all. The shared experience of this list subscribers and OSR’s web
site can be the additional sources.

Max