Re: How to compress LUKS2 header?

On 27/12/2019 21:46, Julio Cesar Faracco - [email protected] wrote:
> Thanks for your suggestions, guys...
> 
> Do you have any recommendation to reduce this header size then?
> Imagine 1000 lab machines.. They are taking 20 GB to backup each header.

Hi,

just few notes:

- used keyslots areas (both in LUKSv1 and LUKSv2) cannot be compressed,
it contains encrypted keyslot data.

- unused keyslot binary areas are filled by a random data on format (or wipe), so
these areas cannot be compressed either. (For LUKSv2 it is the whole binary area.)

That said...

We can probably add some option to wipe unused keyslot areas with zeroes
on backup.

For the header size - for LUKSv2 you can easily decrease header size,
if you do not need more slot area or you do not plan to use reencryption.

Please read this post
https://marc.info/?l=dm-crypt&m=157146906003981&w=2

Milan



> 
> Revert to LUKS v1 type is not a possibility.
> 
> I appreciate your help...
> 
> --
> Julio  Cesar Faracco
> 
>      
> From: dm-crypt <[email protected]> on behalf of Michael Kjörling <michael-/[email protected]>
> Sent: Friday, December 27, 2019 1:20:11 PM
> To: [email protected]
> Subject: [EXTERNAL] Re: [dm-crypt] How to compress LUKS2 header?
>      
> On 27 Dec 2019 10:56 -0500, from gebser-Qz+AbkVSZgBWk0Htik3J/[email protected] (ken):
>> Compressing a file is one step in the encryption of that file.  So if
>> your LUKS2 header file is encrypted, it's also already compressed.
>> Using ZIP on it would yield no further compression.
> 
> No, encryption does not imply compression. Rather, trying to compress
> ciphertext is a largely pointless exercise if the encryption is any
> good in the first place; therefore, _if_ you're going to compress the
> data you're encrypting (keeping in mind that doing so is not always a
> good idea; see compression oracle attacks), then you need to compress
> first, then encrypt, not the other way around.
> 
> I'm pretty sure the LUKS header backup isn't compressed.
> 
_______________________________________________
dm-crypt mailing list
[email protected]
https://www.saout.de/mailman/listinfo/dm-crypt