Re: cryptsetup FAQ - clarification of loop device security guarantees

Thanks, Milan, for the prompt confirmation.

Regards,
forbytten


Sent with Proton Mail secure email.

On Friday, February 7th, 2025 at 2:08 AM, Milan Broz <[email protected]> wrote:

> On 2/6/25 10:04 AM, forbytten wrote:
> 
> > Hi,
> > 
> > In the cryptsetup FAQ, under "2.6 How do I use LUKS with a loop-device?" it states "This can be very handy for experiments". I am seeking clarification of whether the security "guarantees" of such use would still be suitable for production use. I hypothesize they would be, due to:
> 
> 
> Loop devices just remap IOs, they are routinely allocated by cryptsetup itself once you use an image (in file) instead of block device.
> 
> > 2. I would expect the threat model of LUKS2/dm-crypt/aes-xts to include the ability of a threat actor to take a block level image of a physical device and attack it offline, which would be equivalent to having a loop device backing file?
> 
> 
> This is irrelevant to loop devices, you can always create an image and analyze/attack it even without allocation of a loop device.
> 
> Loop device is just a tool that maps a file to virtual block device, nothing more.
> 
> > 3. I would expect a loop device to behave identically to a block device as far as LUKS2/dm-crypt are concerned.
> 
> 
> yes.
> 
> Milan