PPDD for Fedora Core

About PPDD
History
About this page
Notes
Download

About PPDD

PPDD is an encryption system for Linux by Allan Latham, released under the GNU General Public License. It is used for the transparent encryption of disk partitions (though it can also encrypt individual files or filesystem images) and uses the blowfish encryption algorithm. For more information on what it is used for and how it works, please see the author's web site.

History

The original (1.x) version of PPDD was written for the 2.0 series of Linux kernels and was also released for 2.2 when that series became available. That version used a special device driver similar to the loop driver. Version 1.x was incompatible with the 2.4 series of Linux kernels, so eventually PPDD 2.0 was released. This version uses the `cryptoloop' API present in the vanilla kernel (though some small modifications to the kernel source code are still necessary in order to insert some hooks for the PPDD algorithm and also to increase the size of encryption keys used).

It appears that the original author is no longer developing PPDD, but Sakari Ailus has published a long-awaited version of PPDD for Linux 2.6. So now you can use PPDD on your Fedora Core Linux system.

About this page

I have basically taken everyone else's code and packaged it up into Fedora-compatible RPMs, so if you use Fedora it saves you the bother of downloading the kernel sources, patching them and compiling a custom kernel.

The kernel RPMs below are pretty much identical to Fedora's kernels but with the PPDD patch added. (There are also two other patches by me: one fixes a messy stack corruption caused by a conflict between PPDD's large key size and the 4K stacks option used by Fedora's kernel, and the other makes the loop driver auto-load the cryptoloop module if it's not already in place when you request encryption.)

The kernel versions were up to date with Fedora Updates as of mid-September 2005 but I make no guarantee to keep them updated when Fedora releases new updates. (The FC2 kernel is actually a back-port from Fedora's FC3 version.)

I have not signed any of these RPMs (though see the bottom of the page for MD5 sums) and they come with no warranty.

Notes

You need to install three RPMs:
- ppdd-utils – these are the user-space programs from Allan Latham's PPDD-2.0 package. It's not possible to use PPDD without running ppdncrypt at least once to initialise the encryption keys (but it is possible to encrypt single files without kernel support using these utilities).
- losetup-ppdd – this contains the patched versions of losetup, mount and umount which are necessary for setting up encryption loop devices using PPDD. This RPM will not overwrite your existing copies of these programs; instead, it installs them as ppddsetup, ppddmount and ppddumount. It will normally make a symbolic link for losetup in /usr/local/bin, but if you prefer to have the actual binaries changed then you may wish to do this manually after installing the RPM. These utilities are compiled from util-linux version 2.12j and don't include any of Red Hat's patches, so you might wish to continue using the standard system versions except when dealing with encryption. (You probably don't even need the PPDD-patched version of umount anyway.) Note: this RPM wouldn't compile under FC4 because gcc-4 objects to something in the source code. However, the FC3 binary still works on FC4.
- kernel – obviously you need this to get the kernel-based PPDD cryptoloop driver. If you are using FC4 then you might also want to install kernel-devel; this is only needed if you want to compile modules against the new kernel (for FC3 this is included when you install the kernel RPM). Kernels are available in uniprocessor and SMP versions, but only for the i686 architecture. If you need another architecture then you will need to download the SRPM and rebuild it yourself, I'm afraid. Use the command:
  rpmbuild --target=foo --rebuild kernel-bar.src.rpm
  (where foo is your architecture and bar is whatever is necessary to complete the filename).
If you want the kernel to automatically load the cryptoloop module when required then insert the following line into /etc/modprobe.conf.
alias loop-encrypt-18 cryptoloop
For information on how to use PPDD, please see the man pages installed with the ppdds-utils package (starting with ppdd(1)) and also the textual documentation (in /usr/share/doc/ppdd-utils-2.0/).
PPDD in theory supports encrypting your whole hard drive, including the root partition but excluding a small boot partition which is needed to hold the kernel and bootloader. I have no experience of this, but it may well be possible using the supplied RPMs. You'll need an `initramfs' containing at least the modules loop, cryptoloop and ppdd and the program ppddsetup (or ppddmount) together with all the other stuff that usually goes in there. Fedora uses `nash' to run the init script, but there's also Busybox (which can be found on the Fedora install media). Note that `mount' is a built-in function in both nash and busybox, and `losetup' is also a built-in in nash, so keeping the `ppdd' in the names of these programs is probably appropriate in order to avoid executing the wrong one.

Download

Fedora Core 2	Fedora Core 3	Fedora Core 4
kernel.i686	kernel.i686 kernel-smp.i686	kernel.i686 kernel-devel.i686 kernel-smp.i686 kernel-smp-devel.i686
losetup-ppdd.i386	losetup-ppdd.i386	losetup-ppdd.i386 (FC3)
ppdd-utils.i386	ppdd-utils.i386	ppdd-utils.i386

Source code:

FC2 kernel version 2.6.12-1.1376_FC2.ppdd (may need to be compiled on a FC3 machine)
FC3 kernel version 2.6.12-2.3.ppdd_FC3
FC4 kernel version 2.6.12-1.1447_FC4.ppdd
losetup-ppdd version 2.12j-1 (currently won't compile on FC4)
ppdd-utils version 2.0-1

Kernel patches (included in the above RPMs):

loop-stack-overflow.patch – fixes a stack overflow problem
loop-load-crypto.patch – auto-loads the required crypto module if it's not present when requested — needs a "loop-encrypt-n" alias in modprobe.conf where n is the encryption type (18 for cryptoloop).

MD5 sums of the above RPMs.