FreeBSD supports only whole filesystem encryption at device level (with GELI or GBDE), but lacks in kernel cryptographic filesystem that can be used transparently atop of other filesystem. Some progress has been seen here recently with userlevel cryptographic filesystems, but userlevel implementations are slow and relay and 3rd party software not included in base system (namely fuse kmod and library). I propose to implement in kernel cryptographic filesystem utilizing stackable VFS layers (like nullfs+crypto).

1. 3 weeks. Use codebase as a start point. Add trivial encryption (XOR, single key) to simplify development.

2. 1 week. Import XTS implementation into kernel. (I already have one, but it's too memory hungry, fix it, or use one from OpenBSD)

3. 2 weeks. Add kernel device for specifying keys for mounted filesystem. Add userspace configuration utility.

4. Midterm evaluation

5. 1 week. Enable real encryption.

6. 2 weeks. Add per-directory key support.

7. 2 weeks. Implement key chaining.

8. 1 week. Final bug hunting and stress testing.

9. Final evaluation.