| CGD(4) | Device Drivers Manual | CGD(4) | 
cgd —
pseudo-device cgd
cgd driver provides the capability of encrypting
  blocks on their way to and from a disk or partition.
In order to compile support for the cgd
    into your kernel, you must add the driver to your kernel configuration file.
    To do this, add a line similar to:
pseudo-device cgd # cryptographic disk driver
The cgd devices are allocated as
  needed.
aes-cbcaes-xts3des-cbcblowfish-cbcencblkno1cgd.encblkno8cgd and
      provided for backward compatibility. It repeatedly encrypts the block
      number of the physical disk block eight times and uses the result as the
      IV for CBC mode. This method should ensure that each block has a different
      IV and that the IV is reasonably unpredictable. The eightfold encryption
      was not intended and causes a notable performance loss with little (if
      any) increase in security over a single encryption.cgd responds to all of the standard disk
  ioctl(2) calls defined in
  sd(4), and also defines the
  following:
These ioctl(2)'s and
    their associated data structures are defined in
    <dev/cgdvar.h> header.
cgd, then you have irrevocably lost all of
  the data on the disk. Please ensure that you are using an appropriate backup
  strategy.
A cgd device doesn't authenticate data and
    thus it can't guarantee integrity of the encrypted data. In particular, if
    the plaintext is known to an adversary, it is possible to change every
    second block on a disk encrypted in the CBC mode to plaintext blocks of
    their choice. The XTS mode isn't vulnerable to this particular attack but a
    lack of integrity should be taken into account when evaluating security
    risks.
cgd device special files.Roland C. Dowdeswell and John Ioannidis, The CryptoGraphic Disk Driver, Proceedings of the FREENIX Track: 2003 USENIX Annual Technical Conference, USENIX Association, http://www.usenix.org/event/usenix03/tech/freenix03/full_papers/dowdeswell/dowdeswell.pdf, 179-186, June 9-14, 2003.
cgd driver was written by Roland C. Dowdeswell for
  NetBSD. The cgd driver
  originally appeared in NetBSD 2.0.
| August 31, 2018 | NetBSD 9.4 |