Cephalocon 2024

Encrypting data in large storage platforms like Ceph has become a standard practice in the industry. However, when attempting to utilize these features in Ceph, a typical user may find the process overwhelming. One reason may be the lack of a consolidated Ceph Docs document that explains and compares the various encryption solutions available in Ceph. This could assist Ceph users in identifying the optimal solution for their specific use case. My objective is to provide a foundational overview of data encryption in Ceph and clarify the various encryption solutions currently available within Ceph. At the end I will talk about that none of the Ceph encryption solutions give a storage end-user the ability to figure out if someone other than authorized parties have tampered with the data. Therefore I will present a method on how to solve the problem. Our solution is to integrate AEAD ciphers into Ceph (as done in Azure,Google Cloud,AWS) and use OMAP to store the resulting authentication tags. My goal is to initiate a dialogue within the community to ascertain whether the solution I have developed is applicable within the context of Ceph and to get guidance on how to proceed from here