Dirlock: A New Rust Tool to Manage Encrypted Filesystems
summary
Dirlock is a Rust command-line tool that manages kernel-native fscrypt encryption and stores keys as protectors (password, FIDO2, TPM) rather than inventing a new cipher. It integrates with PAM, exposes a D-Bus API prototype, ships under BSD on SteamOS GitLab and appears as an experimental opt-in in SteamOS 3.8. Tests show fscrypt performance comparable or slightly faster than LUKS; TPM use enforces anti-hammering protection and FIDO2 and basic TPM support are implemented. written in Rust, uses fscrypt API.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 1:03Motivation for Dirlock
- 4:15Encryption technology overview
- 10:37LUKS vs fscrypt
- 13:25Why Dirlock was created
- 17:59Dirlock architecture
- 20:06Encryption policies
- 25:02PAM integration
- 26:51Live demo
- 32:12Q&A
related talks
20mCloud-native security in Rust with Keylime
57mFast encrypted backups with Rust
17mPerformant, Readable and Interoperable Rust from Dafny
35mRust for Linux Office Hours
11mA Decade of Rustls
45mBuilding Safe and Secure Systems in Rust
48mStrengthening the Base: Laying the Groundwork for a more robust Rust SDK
46mRust for Linux