I've been using it on Arch Linux since mid-2017, and it's amazing. Much easier and more flexible to set up than LUKS/GELI. I hope FreeBSD will get Datto's encryption soon when they switch to ZoF (their ZoL fork)

Here is the FreeBSD announcement of their move to ZoL.

https://lists.freebsd.org/pipermail/freebsd-current/2018-Dec...

That much easier than typing "geli init", and "zpool create"? :)

No, it's not easier but it's vastly more convenient and flexible. You can encrypt each dataset with different keys, and ZFS allows you to unlock them on import or whenever you want to. You can send and receive them while encrypted. Also ZFS encryption means that I can finally encrypt external HDDs that I share between Linux and FreeBSD without having to resort to ugly hacks.

Where can I find more about Datto's work on encryption?

Why is that special and what can you do with it that you can’t do now with LUKS on the underlying partitions?

Many things... here are the ones I care about:

- you can have different keys for all your "partitions" without having to pre-allocate them

- you can send encrypted incremental snapshots to a host that doesn't have the key (for backups for instance)

- it's using authenticated encryption (as opposed to LUKS with XTS)

Can't these things be done with eCryptfs or EncFS?

> you can have different keys for all your "partitions" without having to pre-allocate them

I imagine its possible to create multiple encrypted directory hierarchies with different keys as they are needed.

> you can send encrypted incremental snapshots to a host that doesn't have the key (for backups for instance)

You can just rsync the encrypted directory hierarchy.

> it's using authenticated encryption (as opposed to LUKS with XTS)

From my quick search, do I understand that "authenticated encryption" is basically hashing or signing the ciphertext or plaintext to make sure that it wasn't altered?

> Can't these things be done with eCryptfs or EncFS?

Possibly, but ZoL/ZFS offers an integrated solution without any setup, etc. That's very appealing for most people.

As an admin I really don't want to have to write a big pile of scripts to do what I could trivially do with ZFS by just setting some zpool or zfs options.

EDIT: I don't know why, but people who haven't "lived" it keep underestimating just how much the convenience of "integration" means. This is not a slight, I just think that it's one of those things that you have to experience to appreciate just how much of a difference it makes.

Also how futzing with disk arrays so often causes data loss.

Storage is unforgiving and you absolutely want the simplest thing to set up - for data safety.

The problem is that when you go to do recovery, maybe years after the thing was set up, it turns out the software has moved on and works differently and your storage media are in a state where at least one has failed and maybe more are dodgy, and if you have set something up with a few different interacting layers it is super easy to do the wrong thing and lose data.

I’ve lost data to “clever” storage setups before and now I stick to the “happy path” (only run the most common, well tested configurations).

This is an excellent point. When working with the ZoL tools I really get the impression that they want to make the easy and safe(!) things easy, and the dangerous things near-impossible.

I don't have that much experience with ZFS/ZoL (truly-)edge cases, but it's very reassuring that they had the right mindset when designing the tools.

> you can send encrypted incremental snapshots to a host that doesn't have the key (for backups for instance)

Isn't this possible already by encrypting the incremental snapshots with a key of your choice, and then just storing that on the remote host?

Sure, but you can't "consolidate" them without re-transferring everything (typically differential snapshots)... whereas with native encryption, you just delete the snapshot.

It also has real potential as a cross platform, encrypted file system. Initially Linux/bsd - but potentially also windows and os x.

Performance

Theoretical performance because on a system with an SSD you don't notice any difference at all with or without LUKS encryption.

At least last I checked, performance was unfortunately pretty crippled through ZFS. The loss was on the order of 75% of sequential read/write.

Has anyone tried it out more recently? Any difference?