-------------------------------------------------------------
        Transparent Cryptographic File System (TCFS) for NetBSD
        Author:         Giuseppe Persiano [giuper@dia.unisa.it] 
                        Giuseppe Cattaneo [cattaneo@dia.unisa.it]
                        Luigi Catuogno    [luicat@tcfs.dia.unisa.it]
                        Aniello Del Sorbo [anidel@tcfs.dia.unisa.it]


        references:     http://tcfs.dia.unisa.it        
                        tcfs-bsd@tcfs.unisa.it        
        -------------------------------------------------------------



	INTRODUCTION
	------------

	This is a prototype of TCFS for NetBSD and it is released only
	for developers. Every other use is strongly discouraged. This is
	a minimal implementation and not all features planned 
	(see the section "What it does not do") have been implemented. 
	The code has been written for NetBSD 1.4, no 
	test have been done on subsequent releases. Somewere the code
	is rather obscure because I followed the motto "First make it works,
	then make it well".


	WHAT IT DOES
	------------

	The TCFS filesystem layer provides: 
	- File encryption/decryption using DES (only)
	- Management of keys on a per-user, per-group and per-process base. 
	- Management of different keys for each filesystem mounted. 
	- A set of utilities for users and system administrator.

	N.B. Currently, it is possible to mount a TCFS filesystem only
	     on top of a FFS filesystem. 
	
	
	WHAT IT DOES NOT DO
	-------------------

	At moment I am working on:
	- Directory encription/decryption (i.e., encryption/decryption
	  of the filenames).

	- Support for multiple cryptographic algorithms. 

	- Independence from underlying filesystem.


	TCFS FILE SYSTEM INSTALLATION
	-----------------------------

	1 Download files netbsd-tcfs.tar.gz and netbsd-mount_tcfs.tar.gz 

	2 Make sure packages /usr/src/sys and /usr/src/sbin have been
	  installed

	3 Expand the tar.gz archives as root

		(cd /; tar xvfz path/to/netbsd-tcfs.tar.gz)
		(cd /; tar xvfz path/to/netbsd-mount_tcfs.tar.gz)

	  the archive netbsd-tcfs.tar.gz contains some files of the
	  original distribution which have been modified. Their original
	  version is preserved by RCS.

	4 Add the line
		file-system	TCFS
	to your kernel configuration file and save it in
		/usr/src/sys/arch/yourarch/conf/YOURKERNEL

	5 Configure and compile YOURKERNEL

		cd /usr/src/sys/arch/yourarch/conf/
		config YOURKERNEL
		cd ../compile/YOURKERNEL
		make depend && make
		cp /netbsd /netbsd.old
		mv netbsd /

	6 Compile the mount_tcfs program

		cd /usr/src/sbin/mount_tcfs
		make install

	7 Reboot the system
		

	TCFS UTILITIES INSTALLATION 
	-----------------------

	1 Download the archive netbsd-tcfs_utils and expand it from root 

		(cd /;tar xvfz path/to/netbsd-tcfs_utils.tar.gz)

	2 Compile tcfs utilities

		cd /usr/src/tcfs-utils_0.1
		make install

	3 Add /usr/tcfs/bin and /usr/tcfs/sbin to your path
	


	MOUNTING TCFS FILESYSTEM
	------------------------

	1 You can mount a TCFS filesystem by running the mount command

	  example:

		mount -t tcfs /mnt2 /mnt/tcfs

	  If you want to mount the filesystem automatically at the boot, edit
	  the file /etc/fstab ad insert a line concerning a TCFS filesystem.

	  example:
	
		/mnt2   /mnt/tcfs       tcfs    rw 	       0 0


	MANAGING PROTECTED FILES
	------------------------

	In order to create a protected file, you need to push a user key
	into TCFS.
	The easiest way to do this is to run

		tcfsputkey -k -p /mnt/tcfs
	
	then type an encryption key.

	At this point, it is possible to encrypt/decrypt files in the
	/mnt/tcfs subtree by using the tcfsflag utility.

	example:

		tcfsputkey -k -p /mnt/tcfs # give TCFS the encryption key
		cd /mnt/tcfs
		echo "Hello World!">first  # the file is not coded
		tcfsflag x first	   # toggles first's cryptographic flag 
					   # now first is stored encrypted
		cat first		   # you see the content of first
					   # i.e., the string "Hello World!"

		vi first		   # edit first
		tcfsflag x first	   # toggles first's cryptographic flag 
					   # now first is stored in clear
		cat first		   # you see the content of first
		tcfsrmkey		   # remove your key from TCFS

	The filesystem does not permit further accesses to encrypted files 
	to any user which has not registered his key. This happens even if the 
	user owns the file. 

	SELECTING THE CIPHER
	--------------------

       The mount_tcfs command searches the file /usr/tcfs/etc/tcfstab 
       to select the cipher to be used for the new tcfs-filesystem.
       Each entry of this file is composed by three fields.

           fs-label:mount-point:cipher-number

       The first field indicate an alias which can be used to alternatively refer
       the associated mount-point (indicated in the second field) by the 
       tcfs support utilities. The third field is the cipher-id
       that must be used encrypt/decryupt files.

       Currently only TDES and RC5 are available and can be referred respectively
       as number 0 and number 1.

       So, if we can configure the filesystem /mnt/tcfs2 (labeled "foo") to 
       use RC5, we can
       insert, in the tcfstab file, the row:
        
           foo:/mnt/tcfs2:1

       Note that the entry default must be present.