Re: Authenticated Encryption with external Data Integrity Fields

Hi,

On 4/2/24 4:15 AM, Alex Lieflander wrote:
> Hello,
> 
> I’m trying to add authenticated encryption to my setup, but I’m
> having trouble to configure some of the parameters. I know that
> `cryptsetup` with --integrity only supports some of the options that
> `integritysetup` does, so I’m wondering if I could instead create the
> integrity layer myself and tell `cryptsetup` to pass down its
> integrity tags (like it does with the --integrity option).

No, you cannot do that. Authenticated encryption through dm-crypt
(with dm-integrity proividend only additional per-sector space) can
be configured only with LUKS2 and cryptsetup.

But the AEAD algorithm configuration for LUKS2 will need some update.
What is missing for your config?

  
> If that isn’t currently possible, are there any plans to add that
> feature in the future?

No, this is not planned. But see below.


> It could also be used to take advantage of physical hardware with T10/DIF support.

Existing hw formats usually only supports 512 + 8 bytes sector, this is not enough for AEAD.

But NVMe drives can be configured to actually support other per-sector additional space.
IMO this feature is currently available only to "enterprise" storage I do not have access to.

But once such configuration is reliable and available on some generic NVMe drives, I definitely
want to add support for it (IOW replace dm-integrity by this hw-only solution - this was actually
long-term plan; dm-integrity was originally only proof-of-concept.)

> Alternatively, are there any
> future plans to support using a separate device for the integrity
> tags like `integritysetup` can with --data-device?

No. We already support detached LUKS2 header, with separate device for integrity
tags this means maintaining 3 separate devices, this would create too complex scenario.

The long-term plan should head to hw backed support mentioned above, that would also
increase performance as it removes the need for dm-integrity journal.

Milan