[dm-crypt] Some questions/clarifications around the LUKS spec
sven at whgl.uni-frankfurt.de
Tue Mar 15 15:21:27 CET 2016
Am 14.03.2016 um 23:27 schrieb Milan Broz:
> On 03/14/2016 10:24 PM, Sven Eschenberg wrote:
>> Updating a spec needs more than just mentioning something. Esp. changes
>> may not be incompatible to previous revisions. If changes are
>> incompatible, a new version is needed (instead of a simple revision). A
>> change to the list of valid values as well as the change in offset
>> calculation to meet alignment requirements are indeed incompatible to
>> the original specification for the v1 header, like it or not. Thus, by
>> introducing these changes, a new version of the on disk format was
>> introduced and this should have been reflected by reversioning the
>> header as well. Having multiple possible specs for the same
>> magic+version is something one really should not go for.
> On-disk format should be backward compatible since cryptsetup 1.0.1,
> no change in version is needed.
> (But there were bugs - so nobody should use such old versions.)
Yes and no. It seems the spec purposefully decided to offer a fixed list
(of ciphers/modes) to make alternative implementations possible. AFAIK
none really exists (in the public domain) and since the old reference
implementation already allowed diverging from the spec it did not really
adhere it either. Any other implementationhonoring the spec before the
xts updates could legitimately consider all headers with unlisted
ciphers invalid and refuse to work (for safety). So there would no real
harm be done, yet it would have been better to make this change clear by
changing the version - afterall there's a 16-bit value and massive
changes could still change the magic string for safety. (in example your
plans for v2)
> Algorithm support is always dynamic thing (you can blacklist kernel
> module, run in FIPS mode that allows only NIST friendly algorithms...)
> So "mandatory" list for LUKS does not make sense in reality.
As I read the LUKS spec it is not limited to the stock kernel crypto
modules, in practise no alternatives showed up so far though. Example:
Imagine the crypto is done externally by a crypto device that is tied to
your box by RDMA and offers a cipher which it names rijndael. So an
implementation that sets up this device would map the name rijndael to
aes and you could still use the encrypted device with any different
kernel. I think limiting the list of ciphers and modes was for full
portability, which makes sense.
> Offset calculation for keyslot is the same as well ... but reading
> that pseudo-algorithm in spec - the slot alignment to 4k diverged
> in 1.0 -> 1.0.1 (2005). Clemens probably forgot to update spec here,
> so this is IMHO bug in spec (and I missed this).
> (Cryptsetup can still open old sector-aligned version - despite this version
> was never in any distro.)
The question though is, would that still hold true the other way round
for old cryptsetup versions (and alternative implementations) prior to
the xts spec update?
> User data alignment was always read from header, it was never calculated
> and I think spec expect it this way.
I think the spec is not clear on this, it suggests the offsets are
stored for safety. It does not explicitly state the stored values should
take precedence, though this is one (sane) possible interpretation. It's
never to late for an errata to clarify this ;-).
More information about the dm-crypt