Mounting a device with messed up integrity header

[email protected]
Newsgroups dev.linux.lists.cryptsetup
Message-ID <[email protected]>
Hi everyone,

I'm trying to mount a partition which was created with "--integrity 
aead" when the integrity feature was brand-spanking new.

Unfortunately integritysetup doesn't recognize the integrity header anymore.
I can unlock the volume with

cryptsetup luksOpen /dev/sdb1/data_crypt

which creates the (symlinks to) devices containing the data and 
integrity information respectively:

/dev/mapper/data_crypt (containing an ext4 file system)
/dev/mapper/data_cryptdata_crypt_dif

but because the integrity check fails, I get I/O errors when trying to 
mount or fsck the corresponding /dev/mapper/data_crypt device.
I assume this is because of issues with the integrity check as described 
in https://gitlab.com/cryptsetup/cryptsetup/-/issues/490#note_227927246.

cryptsetup luksDump /dev/sdb1
correctly reports the integrity mode to be aead:

LUKS header information
Version:        2
Epoch:          5
Metadata area:  16384 [bytes]
Keyslots area:  16744448 [bytes]
UUID:           XXXX-XXXX-XXXX-XXXXX-XXXXXXXXXXX
Label:          DATA_crypt
Subsystem:      (no subsystem)
Flags:        (no flags)

Data segments:
   0: crypt
  offset: 16777216 [bytes]
  length: (whole device)
  cipher: morus1280-random
  sector: 4096 [bytes]
  integrity: aead


As I wrote in the beginning, the output of

integritysetup dump /dev/sdb1
is:
No integrity superblock detected on /dev/sdb1.

Which means that

integritysetup open --integrity-recovery-mode /dev/sdb1 data_crypt 
data_crypt

fails with the same error, just as using --integrity-recalculate does.

I'm looking for the correct way to proceed. I don't care if it's by 
recalculating/recreating the integrity header & data, by disabling 
integrity checking temporarily or permanently or my modifying the header 
and stripping the integrity part.

Unfortunately I couldn't find a good writeup online or information in 
the faq regarding the best way to go forward in such a case.
I also searched the mailing list, but it's either well hidden or I 
didn't choose the right search terms.

If more verbose debugging output or the full original command with which 
the partition was encrypted would be helpful, I'll gladly provide them.

Thanks in advance for any hints!
Tom
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.