Index: /trunk/src/VBox/Devices/Storage/DrvVD.cpp
===================================================================
--- /trunk/src/VBox/Devices/Storage/DrvVD.cpp	(revision 51898)
+++ /trunk/src/VBox/Devices/Storage/DrvVD.cpp	(revision 51899)
@@ -189,8 +189,7 @@
     /** Cryptographic support
      * @{ */
-    /** Used algorithm, NULL means no encryption. */
-    char                    *pszEncryptionAlgorithm;
-    /** Stored key id, queried from the crypto filter. */
-    char                    *pszKeyId;
+    /** Pointer to the CFGM node containing the config of the crypto filter
+     * if enable. */
+    PCFGMNODE                pCfgCrypto;
     /** Config interface for the encryption filter. */
     VDINTERFACECONFIG        VDIfCfg;
@@ -633,44 +632,4 @@
 {
     return CFGMR3QueryBytes((PCFGMNODE)pvUser, pszName, ppvData, cbData);
-}
-
-
-/*******************************************************************************
-*   VD Configuration interface implementation for the encryption support       *
-*******************************************************************************/
-
-static bool drvvdCfgEncAreKeysValid(void *pvUser, const char *pszValid)
-{
-    return true;
-}
-
-static int drvvdCfgEncQuerySize(void *pvUser, const char *pszName, size_t *pcb)
-{
-    PVBOXDISK pThis = (PVBOXDISK)pvUser;
-    int rc = VINF_SUCCESS;
-
-    if (!strcmp(pszName, "Algorithm"))
-        *pcb = strlen(pThis->pszEncryptionAlgorithm) + 1;
-    else if (!strcmp(pszName, "KeyId"))
-        *pcb = strlen(pThis->pszKeyId) + 1;
-    else
-        rc = VERR_NOT_SUPPORTED;
-
-    return rc;
-}
-
-static int drvvdCfgEncQuery(void *pvUser, const char *pszName, char *pszString, size_t cchString)
-{
-    PVBOXDISK pThis = (PVBOXDISK)pvUser;
-    int rc = VINF_SUCCESS;
-
-    if (!strcmp(pszName, "Algorithm"))
-        rc = RTStrCopy(pszString, cchString, pThis->pszEncryptionAlgorithm);
-    else if (!strcmp(pszName, "KeyId"))
-        rc = RTStrCopy(pszString, cchString, pThis->pszKeyId);
-    else
-        rc = VERR_NOT_SUPPORTED;
-
-    return rc;
 }
 
@@ -1591,5 +1550,5 @@
     PVBOXDISK pThis = PDMIMEDIA_2_VBOXDISK(pInterface);
 
-    if (   pThis->pszEncryptionAlgorithm
+    if (   pThis->pCfgCrypto
         && !pThis->pIfSecKey)
     {
@@ -1651,5 +1610,5 @@
           off, pvBuf, cbWrite, cbWrite, pvBuf));
 
-    if (   pThis->pszEncryptionAlgorithm
+    if (   pThis->pCfgCrypto
         && !pThis->pIfSecKey)
     {
@@ -1724,5 +1683,5 @@
     int rc = VINF_SUCCESS;
 
-    if (pThis->pszEncryptionAlgorithm)
+    if (pThis->pCfgCrypto)
     {
         PVDINTERFACE pVDIfFilter = NULL;
@@ -1742,5 +1701,5 @@
 
             rc = VDInterfaceAdd(&pThis->VDIfCfg.Core, "DrvVD_Config", VDINTERFACETYPE_CONFIG,
-                                pThis, sizeof(VDINTERFACECONFIG), &pVDIfFilter);
+                                pThis->pCfgCrypto, sizeof(VDINTERFACECONFIG), &pVDIfFilter);
             AssertRC(rc);
     
@@ -1923,5 +1882,5 @@
     PVBOXDISK pThis = PDMIMEDIAASYNC_2_VBOXDISK(pInterface);
 
-    if (   pThis->pszEncryptionAlgorithm
+    if (   pThis->pCfgCrypto
         && !pThis->pIfSecKey)
     {
@@ -1961,5 +1920,5 @@
     PVBOXDISK pThis = PDMIMEDIAASYNC_2_VBOXDISK(pInterface);
 
-    if (   pThis->pszEncryptionAlgorithm
+    if (   pThis->pCfgCrypto
         && !pThis->pIfSecKey)
     {
@@ -2054,5 +2013,5 @@
     PVBOXDISK pThis = PDMINS_2_DATA(pDrvIns, PVBOXDISK);
 
-    Assert (!pThis->pszEncryptionAlgorithm);
+    Assert (!pThis->pCfgCrypto);
 
     switch (enmXferDir)
@@ -2373,14 +2332,4 @@
         pThis->pszBwGroup = NULL;
     }
-    if (pThis->pszEncryptionAlgorithm)
-    {
-        MMR3HeapFree(pThis->pszEncryptionAlgorithm);
-        pThis->pszEncryptionAlgorithm = NULL;
-    }
-    if (pThis->pszKeyId)
-    {
-        MMR3HeapFree(pThis->pszKeyId);
-        pThis->pszKeyId = NULL;
-    }
 }
 
@@ -2418,5 +2367,5 @@
     pThis->uMergeSource                 = VD_LAST_IMAGE;
     pThis->uMergeTarget                 = VD_LAST_IMAGE;
-    pThis->pszEncryptionAlgorithm       = NULL;
+    pThis->pCfgCrypto                   = NULL;
     pThis->pIfSecKey                    = NULL;
 
@@ -2833,30 +2782,12 @@
         /* Check VDConfig for encryption config. */
         if (pCfgVDConfig)
-        {
-            rc = CFGMR3QueryStringAlloc(pCfgVDConfig, "EncryptionAlgorithm", &pThis->pszEncryptionAlgorithm);
-            if (RT_FAILURE(rc) && rc != VERR_CFGM_VALUE_NOT_FOUND)
-            {
-                rc = PDMDRV_SET_ERROR(pDrvIns, rc,
-                                      N_("DrvVD: Configuration error: Querying \"EncryptionAlgorithm\" as string failed"));
-                break;
-            }
-            else
-                rc = VINF_SUCCESS;
-        }
-
-        if (pThis->pszEncryptionAlgorithm)
-        {
-            rc = CFGMR3QueryStringAlloc(pCfgVDConfig, "KeyId", &pThis->pszKeyId);
-            if (RT_FAILURE(rc))
-            {
-                rc = PDMDRV_SET_ERROR(pDrvIns, rc,
-                                      N_("DrvVD: Configuration error: Querying \"KeyId\" as string failed"));
-                break;
-            }
-
+            pThis->pCfgCrypto = CFGMR3GetChild(pCfgVDConfig, "CRYPT");
+
+        if (pThis->pCfgCrypto)
+        {
             /* Setup VDConfig interface for disk encryption support. */
-            pThis->VDIfCfg.pfnAreKeysValid  = drvvdCfgEncAreKeysValid;
-            pThis->VDIfCfg.pfnQuerySize     = drvvdCfgEncQuerySize;
-            pThis->VDIfCfg.pfnQuery         = drvvdCfgEncQuery;
+            pThis->VDIfCfg.pfnAreKeysValid  = drvvdCfgAreKeysValid;
+            pThis->VDIfCfg.pfnQuerySize     = drvvdCfgQuerySize;
+            pThis->VDIfCfg.pfnQuery         = drvvdCfgQuery;
             pThis->VDIfCfg.pfnQueryBytes    = NULL;
 
@@ -3102,5 +3033,5 @@
         && !pThis->fShareable
         && !fDiscard
-        && !pThis->pszEncryptionAlgorithm /* Disk encryption disables the block cache for security reasons */
+        && !pThis->pCfgCrypto /* Disk encryption disables the block cache for security reasons */
         && RT_SUCCESS(rc))
     {
Index: /trunk/src/VBox/Main/src-client/ConsoleImpl2.cpp
===================================================================
--- /trunk/src/VBox/Main/src-client/ConsoleImpl2.cpp	(revision 51898)
+++ /trunk/src/VBox/Main/src-client/ConsoleImpl2.cpp	(revision 51899)
@@ -4211,10 +4211,30 @@
                         if (values[ii] && *values[ii])
                         {
+                            /* Put properties of filters in a separate config node. */
                             Utf8Str name = names[ii];
                             Utf8Str value = values[ii];
-                            InsertConfigString(pVDC, name.c_str(), value);
-                            if (    name.compare("HostIPStack") == 0
-                                &&  value.compare("0") == 0)
-                                fHostIP = false;
+                            size_t offSlash = name.find("/", 0);
+                            if (   offSlash != name.npos
+                                && !name.startsWith("Special/"))
+                            {
+                                com::Utf8Str strFilter;
+                                com::Utf8Str strKey;
+
+                                hrc = strFilter.assignEx(name, 0, offSlash); H();
+                                hrc = strKey.assignEx(name, offSlash + 1, name.length() - offSlash - 1); /* Skip slash */ H();
+
+                                PCFGMNODE pCfgFilterConfig = CFGMR3GetChild(pVDC, strFilter.c_str());
+                                if (!pCfgFilterConfig)
+                                    InsertConfigNode(pVDC, strFilter.c_str(), &pCfgFilterConfig);
+
+                                InsertConfigString(pCfgFilterConfig, strKey.c_str(), value);
+                            }
+                            else
+                            {
+                                InsertConfigString(pVDC, name.c_str(), value);
+                                if (    name.compare("HostIPStack") == 0
+                                    &&  value.compare("0") == 0)
+                                    fHostIP = false;
+                            }
                         }
                     }