Re: How to compress LUKS2 header?

On Fri, Dec 27, 2019 at 21:46:50 CET, Julio Cesar Faracco - [email protected] wrote:
> Thanks for your suggestions, guys...
> 
> Do you have any recommendation to reduce this header size then?
> Imagine 1000 lab machines.. They are taking 20 GB to backup each header.

Your situation becomes clearer ;-)
What I do not quite get is why you have header backups but 
(apparently) no data backups. You usually should do both.

As Milan suggested, you can cut off the header after the last 
used keyslot. In LUKS 1 you could also do some ciper magic
(See FAQ Item 6.13), no idea whether that works with LUKS 2
or whether it is secure for your situation.

Other than that, 20GB is not that much in this day and age. 

Regards,
Arno

 
> Revert to LUKS v1 type is not a possibility.
> 
> I appreciate your help...
> 
> --
> Julio  Cesar Faracco
> 
>     
> From: dm-crypt <[email protected]> on behalf of Michael Kjörling <[email protected]>
> Sent: Friday, December 27, 2019 1:20:11 PM
> To: [email protected]
> Subject: [EXTERNAL] Re: [dm-crypt] How to compress LUKS2 header?
>     
> On 27 Dec 2019 10:56 -0500, from [email protected] (ken):
> > Compressing a file is one step in the encryption of that file.  So if
> > your LUKS2 header file is encrypted, it's also already compressed. 
> > Using ZIP on it would yield no further compression.
> 
> No, encryption does not imply compression. Rather, trying to compress
> ciphertext is a largely pointless exercise if the encryption is any
> good in the first place; therefore, _if_ you're going to compress the
> data you're encrypting (keeping in mind that doing so is not always a
> good idea; see compression oracle attacks), then you need to compress
> first, then encrypt, not the other way around.
> 
> I'm pretty sure the LUKS header backup isn't compressed.
> 
> -- 
> Michael Kjörling •  https://urldefense.proofpoint.com/v2/url?u=https-3A__michael.kjorling.se&d=DwIGaQ&c=jf_iaSHvJObTbx-siA1ZOg&r=ZRo7ioNm6-KW9XMwc8-3Aqc6TBVFd8_9yk27A36m0u0&m=rQUoPqXVjthTyHfeJ02oW6vvxq9wwNPVBB1anj-N7kI&s=worTWmhb84zgfP27r3HYCW1CSw9M_93ZnC2rb_81SfQ&e=  • [email protected]
>  “Remember when, on the Internet, nobody cared that you were a dog?”
> 
> _______________________________________________
> dm-crypt mailing list
> [email protected]
> https://urldefense.proofpoint.com/v2/url?u=https-3A__www.saout.de_mailman_listinfo_dm-2Dcrypt&d=DwIGaQ&c=jf_iaSHvJObTbx-siA1ZOg&r=ZRo7ioNm6-KW9XMwc8-3Aqc6TBVFd8_9yk27A36m0u0&m=rQUoPqXVjthTyHfeJ02oW6vvxq9wwNPVBB1anj-N7kI&s=pg-I-9_hpvWliVyuS2yTJk_kfFNljzWR1YSIUcHluIg&e=
>     
> _______________________________________________
> dm-crypt mailing list
> [email protected]
> https://www.saout.de/mailman/listinfo/dm-crypt

-- 
Arno Wagner,     Dr. sc. techn., Dipl. Inform.,    Email: [email protected]
GnuPG: ID: CB5D9718  FP: 12D6 C03B 1B30 33BB 13CF  B774 E35C 5FA1 CB5D 9718
----
A good decision is based on knowledge and not on numbers. -- Plato

If it's in the news, don't worry about it.  The very definition of 
"news" is "something that hardly ever happens." -- Bruce Schneier
_______________________________________________
dm-crypt mailing list
[email protected]
https://www.saout.de/mailman/listinfo/dm-crypt