[dm-crypt] minimal LUKS container size
arno at wagner.name
Fri Dec 16 08:14:10 CET 2011
On Wed, Dec 07, 2011 at 01:03:26PM +0100, Milan Broz wrote:
> Minimal size depends on two things:
> - volume key size
> - alignment of data area
> Cryptsetup 1.3 by default aligns data to 1MB offset multiple, that's why
> you see this change.
> You can switch to old alignment by using data alignment override, e.g.
> cryptsetup luksFormat -s 128 --align-payload=8
> (So here forcing keysize to 128bit and forcing alignment to 4k offset.
> - vaule is in 512 byte sectors.
> This is perhaps the smallest header possible while still using
> reasonable key size - 1032 x 512 bytes sectors ~ 520kB)
> (But also note that misalignment to flash memory block can have
> some performance effects.)
> Anyway, some example in FAQ would be nice.
Just added this. Tested with 1.3.1 and also 1.4.1 for arc4.
To my surprise, giving alignment --align-payload=1 (or = 2) results
in a data-area staring at 0x101000, while --align-payload=0 gives
2MiB offset. Is this rounded up to multiples of 8? I had a brief
look into the sources but did not find the relevant code.
The full behaviour should go into the man-page under the
explanation for "--align-payload".
Data area size can be 512 bytes (verified with loop-device), but
not 0 bytes, as this gives an ioctl-error on opening.
For cipher, the most extreme I found is RC4 with an 8 bit key.
This can be luksFormat-ed, but fails on opening. This is
probably a bug when using arc4, as it fails for 128 bit as well.
(tested with 1.4.1).
Blowfish with 64 bits works though, but is insecure, so added with
Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email: arno at wagner.name
GnuPG: ID: 1E25338F FP: 0C30 5782 9D93 F785 E79C 0296 797F 6B50 1E25 338F
Cuddly UI's are the manifestation of wishful thinking. -- Dylan Evans
If it's in the news, don't worry about it. The very definition of
"news" is "something that hardly ever happens." -- Bruce Schneier
More information about the dm-crypt