Raw mode decryption discussion

[jmwilson]

The command options for RAW mode decryption are hard to understand, and I think would benefit from rethinking or removal. After reading the SCSI specification for tape drives (SSP-5), the nominal reason RAW decrypt mode exists is for copying encrypted data from one volume to another without needing the key (referred to "keyless copy"). The source drive is set to return raw encrypted data, and the destination drive is put into "external" encryption mode where it assumes the incoming data is already encrypted.

In order for this to work, either the device needs to support RAW output by default, or a flag needs to be set when encryption is enabled, and this setting applies on a per-record basis when writing to the tape (hence the --protect and --unprotect options).

However, stenc doesn't support the external encrypt mode to go along with raw decrypt mode, and moreover doesn't allow encrypt and decrypt settings to be controlled independently. For example, it is not allowed to turn off writing encrypted data, while leaving decryption on. This is fine, it just means stenc is opinionated and only supports the typical use case where encrypt and decrypt settings are set in tandem.

Ideas:

1. Drop --rawread and associated --protect/--unprotect options. --mixed makes sense to keep, so in this case stenc will support 3 configurations: encrypt on + decrypt on, encrypt on + decrypt mixed, and encrypt off + decrypt off.
2. Rename options to make their purpose clearer, such as --decrypt-raw and --decrypt-mixed, and change --unprotect to --allow-raw-decrypt. If keyless copy is something stenc should support, corresponding options for external encryption mode should be added.
3. Allow completely independent setting of encrypt and decrypt settings, like -e external -d mixed --allow-raw-decrypt or something like that.

Basically, first consider what the reasons are for allowing RAW decrypt mode in the program. Is it for supporting keyless copy, or completeness, or something else? If for keyless copy, we should also add support for external encryption mode. If completeness, I think that is a bad idea since there are also dozens of other option flags stenc doesn't support that would better be handled in custom site builds for those who need it, and these settings are difficult to use correctly.

[jonasstein]

I could imagine that RAW decrypt mode is interesting for security tests / pentesting. I agree, that the options and the description is confusing. But the new suggestion is not easy to understand yet.