[RFC] LUKS

Hi list.

I just had a talk with th on IRC and he pointed me to

	http://luks.endorphin.org/

which seems to be the "de facto" standard for software harddisk encryption
on Linux systems these days.
LUKS works like this:
Consider this your partition you want to encrypt:

	|-----------------------------------------------|

Now LUKS puts itself into the first 1032 blocks of the partition:

	|LUKS|------------------------------------------|

1032 equals to 0.5 Megabyte.

In there it stores up to eight actual encryption keys which can be unlocked
using a passphrase.
This means that it isn't possible to go to and back from an encrypted
filesystem which IMO is a big drawback and one I personally do not want to
take.

I propose the following:

All filesystems we create should be passed through dmsetup which configures
them to not use those first 1032 blocks. This enables the user to use dd
to encrypt or decrypt a filesystem should the need arise to do so.


My question:
- Do we stay with the way we are now, using our own system to setup
	encryption?
- Do we use my proposal to be able to encrypt/decrypt our filesystems
	post-install?
- Or should we just use cryptsetup-luks and lose that ability, forcing
	us to reinstall when we decide that we want an encrypted fs?


Greetings,
	Benjamin
-- 
Benjamin 'blindCoder' Schieder
Registered Linux User #289529: http://counter.li.org
finger blindcoder-1k+CIuW/[email protected] | gpg --import
-- 
/lusr/bin/brain: received signal: SIGIDIOT

_______________________________________________
rock-devel mailing list
[email protected]
http://www.rocklinux.net/mailman/listinfo/rock-devel

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (GNU/Linux)

iD8DBQFEZFhyr0OTeImXvg8RAlKvAJ0T0ekOeXVXbxZTAyTOtotuvK4cPwCfXzP3
xEYJO+UBt5GkhVHo3PkcYMQ=
=T5Op
-----END PGP SIGNATURE-----