[dm-crypt] LUKS header cksum?
arno at wagner.name
Fri Jul 20 22:42:46 CEST 2012
On Fri, Jul 20, 2012 at 11:25:13AM -0700, Two Spirit wrote:
> I was wondering if there is a checksum on the LUKS header? I didn't read
> the whole thing, but a quick look at
> specs, seems to only have
> a checksum of the master-key, not of the whole header.
There is no header checksum. It is not needed. Any corruption
that may be introduced by defective RAM, busses, controllers
and disks should be detectet at the same time a checksum
error would be detected, namely on luksOpen. Note that these
only be introduced on header writes or if the disk goes south.
In tha later case, the disk has its own checksums and should
report the error and refuse to actually read the header.
> When I found my corruption, the cryptsetup seemed to work fine and nothing
> indicated to me that there was some corruption.
> I didn't run isLuks to see what that would have said. Evidently there was
> enough information around to consider the LUKS was
> there, and keep the running system working OK, but not enough to recognize
> that there was corruption and that my
> passphrases wouldn't work.
Are you talking about a _mapped_ LUKS device? The header is not
used after the mapping is established. You could completely wipe
the header and key-slots and the mapping would remain
operational and no error would ever be reported while the
mapping remains active. A header checksum would not change
You could use --test-passphrase to see whether the header and
specific key-slot is still intact for a mapped device though.
Arno Wagner, Dr. sc. techn., Dipl. Inform., Email: arno at wagner.name
GnuPG: ID: 1E25338F FP: 0C30 5782 9D93 F785 E79C 0296 797F 6B50 1E25 338F
One of the painful things about our time is that those who feel certainty
are stupid, and those with any imagination and understanding are filled
with doubt and indecision. -- Bertrand Russell
More information about the dm-crypt