Re: [Question] Distinction responsibilities LUKS and dm-crypt

dm-crypt/dm-verity are the kernel drivers doing the actual encryption
verification.
As is e.g. md* for Linux DM software raid.


LUKS is a container format keeping data like encrypted keys or
integrity data... as well as space for some operations like device re-
encrypt.
As is the "mdadm container" (not sure whether this has an official
name... I mean the containers with version 0, 0.90, 1, 1.0, 1.1, 1.2)
for Linux DM software raid.

You could have e.g. encryption without LUKS (which has some pros and
"cons" - mostly pros, I'd say)... because one encrypted block maps
exactly to one decrypted block.
You can't have integrity protection/AEAD without a special disk format
OR extra device... as the integrity data needs to go somewhere.

cryptsetup/veritysetup are the userland tools allowing to manage the
above.
As mdadm would be for Linux DM software raid.


Cheers,
Chris.


On Thu, 2022-03-31 at 18:21 +0000, Surmont Jasper wrote:
> Dear, keep in mind I’m fairly new to Linux kernel development and
> similar, so my question might sound stupid. 
>  
> Reading through the documentation of both dm-crypt and LUKS, 
> I understand that LUKS is a format specification 
> to allow FDE, and that dm-crypt is a dm target which allows
> encryption / decryption of writes / reads to the block device. 
> 
> However, I'm unsure about
> what each of these now exactly provides (ie what are the
> responsibilities). In
> the slides  (look link at the bottom) that the author (Milan Broz)
> made,
> it mentions that LUKS2 can also provide integrity protection (hence
> making the
> encryption authenticated). From this, and also reading the Luks1
> specification
> I think this is not possible in LUKS1. However, later in the slides
> it talks
> how dm-crypt allows for authenticated encryption. This is where I'm
> confused;
> do we assume we use LUKS2? 
> 
> I feel like I'm not really grasping the main function and
> responsibilities of both LUKS and dm-crypt. 
> Thanks! 
>  
> Slides:
> https://archive.fosdem.org/2018/schedule/event/cryptsetup/attachments/slides/2506/export/events/attachments/cryptsetup/slides/2506/fosdem18_cryptsetup_aead.pdf
>  
>  
> Sincerely, Jasper Surmont  
>