Re: LUKS container creation without device mapper or loop device access

--===============6982116298448004152==
Content-Type: multipart/alternative; boundary="0000000000007fae9d05c611e688"

--0000000000007fae9d05c611e688
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi,

Thanks a lot! My tests around your commands look really promising : This is
exactly what I've looked for.

Best Regards,

Le mer. 30 juin 2021 =C3=A0 11:10, Ondrej Kozina <[email protected]> a =C3=
=A9crit :

> Hi,
>
> On 6/18/21 10:22 AM, Yoann CONGAL wrote:
> >
> >  From what I understood of the internals of cryptsetup, it knows how to
> > build the LUKS header but rely on the dm-crypt module of the kernel to
> > do the actual data encryption. (Please correct me if I'm wrong)
>
> Yes, dm-crypt is usually only necessary to access data when LUKS device
> is activated (unlocked). That said, there are some exceptions. For
> example when crypto backend used in libcryptsetup (or kernel crypto API)
> does not support used cipher/mode for some reason. In that case we
> fallback to use dm-crypt to perform encryption/decryption of LUKS
> keyslots. It also requires root privs in this corner case.
>
> >
> > So, I have two questions :
> > * Do you know of a tool that does the full LUKS image (header and
> > data) fully in userland? (I did search for it and found nothing)
> > * If the above answer is "It does not exist yet", would you be open to
> > its inclusion in cryptsetup? My guess is that a tightly managed intern
> > may handle this.
> With default cipher (aes) you can use new LUKS2 reencryption code for
> that. LUKS2 header (cryptsetup format) can be created fully without need
> to use dm-crypt already, but If you need to encrypt existing data you
> can use following command:
>
> This should work without root privs. It will create separate detached
> LUKS2 header in <new_detached_LUKS2_header>:
>
> cryptsetup reencrypt --encrypt <my_data_file> --header
> <new_detached_LUKS2_header> --disable-locks
>
> For header put in the beginning of the data file you can use:
>
> cryptsetup reencrypt --encrypt <my_data_file> --reduce-device-size 32M
> --disable-locks
>
> just bear in mind that my_data_file must have 32MiB spare space at the
> end (iow there should be no useful data at the end of the file).
>
> With root privs, you can drop --disable-locks parameter and also use
> block devices in place of <my_data_file>.
>
> Look for more information related to online encryption under "reencrypt"
> action of cryptsetup.
>
> Kind regards
> Ondrej K.
>
>

--=20
Yoann Congal
Smile ECS - Expert technique
[email protected]

--0000000000007fae9d05c611e688
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div>Hi,</div><div><br></div><div>Thanks a lot! My tests a=
round your commands look really promising : This is exactly what I&#39;ve l=
ooked for.<br></div><div><br></div><div>Best Regards,<br></div><br><div cla=
ss=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail_attr">Le=C2=A0mer. 30 ju=
in 2021 =C3=A0=C2=A011:10, Ondrej Kozina &lt;<a href=3D"mailto:okozina@redh=
at.com">[email protected]</a>&gt; a =C3=A9crit=C2=A0:<br></div><blockquote=
 class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px so=
lid rgb(204,204,204);padding-left:1ex">Hi,<br>
<br>
On 6/18/21 10:22 AM, Yoann CONGAL wrote:<br>
&gt; <br>
&gt;=C2=A0 From what I understood of the internals of cryptsetup, it knows =
how to<br>
&gt; build the LUKS header but rely on the dm-crypt module of the kernel to=
<br>
&gt; do the actual data encryption. (Please correct me if I&#39;m wrong)<br=
>
<br>
Yes, dm-crypt is usually only necessary to access data when LUKS device <br=
>
is activated (unlocked). That said, there are some exceptions. For <br>
example when crypto backend used in libcryptsetup (or kernel crypto API) <b=
r>
does not support used cipher/mode for some reason. In that case we <br>
fallback to use dm-crypt to perform encryption/decryption of LUKS <br>
keyslots. It also requires root privs in this corner case.<br>
<br>
&gt; <br>
&gt; So, I have two questions :<br>
&gt; * Do you know of a tool that does the full LUKS image (header and<br>
&gt; data) fully in userland? (I did search for it and found nothing)<br>
&gt; * If the above answer is &quot;It does not exist yet&quot;, would you =
be open to<br>
&gt; its inclusion in cryptsetup? My guess is that a tightly managed intern=
<br>
&gt; may handle this.<br>
With default cipher (aes) you can use new LUKS2 reencryption code for <br>
that. LUKS2 header (cryptsetup format) can be created fully without need <b=
r>
to use dm-crypt already, but If you need to encrypt existing data you <br>
can use following command:<br>
<br>
This should work without root privs. It will create separate detached <br>
LUKS2 header in &lt;new_detached_LUKS2_header&gt;:<br>
<br>
cryptsetup reencrypt --encrypt &lt;my_data_file&gt; --header <br>
&lt;new_detached_LUKS2_header&gt; --disable-locks<br>
<br>
For header put in the beginning of the data file you can use:<br>
<br>
cryptsetup reencrypt --encrypt &lt;my_data_file&gt; --reduce-device-size 32=
M <br>
--disable-locks<br>
<br>
just bear in mind that my_data_file must have 32MiB spare space at the <br>
end (iow there should be no useful data at the end of the file).<br>
<br>
With root privs, you can drop --disable-locks parameter and also use <br>
block devices in place of &lt;my_data_file&gt;.<br>
<br>
Look for more information related to online encryption under &quot;reencryp=
t&quot; <br>
action of cryptsetup.<br>
<br>
Kind regards<br>
Ondrej K.<br>
<br>
</blockquote></div><br clear=3D"all"><br>-- <br><div dir=3D"ltr" class=3D"g=
mail_signature"><div dir=3D"ltr"><font face=3D"Raleway, regular">Yoann Cong=
al</font><div><font face=3D"Raleway, regular">Smile ECS - Expert technique<=
/font></div><div><font face=3D"Raleway, regular"><a href=3D"mailto:yoann.co=
[email protected]" target=3D"_blank">[email protected]</a></font></div></di=
v></div></div>

--0000000000007fae9d05c611e688--

--===============6982116298448004152==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
dm-crypt mailing list -- [email protected]
To unsubscribe send an email to [email protected]

--===============6982116298448004152==--