Re: cryptsetup FAQ - clarification of loop device security guarantees

On 2/6/25 10:04 AM, forbytten wrote:
> Hi,
> 
> In the cryptsetup FAQ, under "2.6 How do I use LUKS with a loop-device?" it states "This can be very handy for experiments". I am seeking clarification of whether the security "guarantees" of such use would still be suitable for production use. I hypothesize they would be, due to:

Loop devices just remap IOs, they are routinely allocated by cryptsetup itself once you use an image (in file) instead of block device.
  
> 2. I would expect the threat model of LUKS2/dm-crypt/aes-xts to include the ability of a threat actor to take a block level image of a physical device and attack it offline, which would be equivalent to having a loop device backing file?

This is irrelevant to loop devices, you can always create an image and analyze/attack it even without allocation of a loop device.

Loop device is just a tool that maps a file to virtual block device, nothing more.
  
> 3. I would expect a loop device to behave identically to a block device as far as LUKS2/dm-crypt are concerned.

yes.

Milan