I'd like to be able to revsion control files encrypted via EFS on NTFS
filesystems on the windows platform. That requires client software to
use the "raw APIs" to get the encrypted data and keys instead of using
normal file APIs and thus getting the data decrypted.
The EFS wiki explains the general idea:
http://en.wikipedia.org/wiki/Encrypting_File_System
...and in particular the raw API:
"The most significant way of preventing the decryption-on-copy is
using backup applications that are aware of the "Raw" APIs. Backup
applications that have implemented these Raw APIs will simply copy the
encrypted file stream and the $EFS alternate data stream as a single
file. In other words, the files are "copied" (e.g. into the backup
file) in encrypted form, and are not decrypted during backup."
"Backup and Restore of Encrypted Files" from MSDN
http://msdn.microsoft.com/en-us/library/aa363783.aspx
Here's the operation scenario:
Currently we encrypt a password escrow file using gpgutils but
managing the master password is a pain to trak who has the password
and which version over time.
Instead we'd like to use EFS on Windows which manages encrypting files
with multiple keays for the users accessing the files, keeps the keys
brokered in AD, and offers the ability to set up key recovery agents
in case everyone loses their private keys. This is a much more
manageable solution.
However currently Tortoise uses the normal file APIs and if the user
is authorized to access the files being checked in, the files are
decryped transparently as part of normal file i/o.
We'd like that there be an option to use the raw APIs and check in/out
the encrypted files as binary objects. NTFS will handle the keys so
that if someone checks out files they don't have permission to view
contents, they just get encrypted content.
This would be really cool for Tortoise SVN to support as it's a client-
side feature and requires no SVN direct support.
------------------------------------------------------
http://tortoisesvn.tigris.org/ds/viewMessage.do?dsForumId=4061&dsMessageId=1054160
To unsubscribe from this discussion, e-mail: [users-unsubscribe_at_tortoisesvn.tigris.org].
Received on 2009-01-26 11:08:56 CET