Re: Disabling integrity metadata verification

Hi,

On 5/11/25 10:25 AM, Marc SCHAEFER wrote:
...
> So, if I understand well, integrity with cryptsetup is implemented with a HMAC
> that needs cleartext data (just before encryption) and produce hashed-signed
> integrity data that protects against tampering and is not fixable by an
> attacker (resistant to voluntary corruption).

Cryptsetup (dm-crypt) always use AEAD (authenticated encryption).

Simplified, this can be constructed two ways

  - it is "true" AEAD algorithm (like AEGIS) with one key. You cannot separate
authenticated tag calculation here.

- it is constructed as combination of length-preserving cipher (AES-XTS) and
authentication tag (HMAC). It uses two independent keys in this case.
While we use kernel AEAD interface, it can be split and the authentication
tag verification ignored.

So you can ignore authentication tag in the second option, but you cannot "fix"
it without knowledge of the key.

> Where if I create a dm-integrity layer with a luks crypted volume on top, I get
> integrity, but an attacker can modify the crypted data and the hash easily
> (only resistant to accidental corruption).

I am not sure I understand what you mean. there is always dm-integrity, but
in the case of AEAD it provides only storage, dm-crypt performs both encryption
and authentication.

Stacking dm-crypt with length-preserving encryption over standalone dm-integrity
with HMAC over ciphertext (produced by dm-crypt above) does not make much sense,
but authentication tag still cannot be modified by attacker as HMAC is keyed algorithm.

Use of non-keyed algorithms for integrity protection (xxhash, CRC or plain hash) does
not much sense in combination with encryption, but it can be useful for triggering
recovery in RAID in the case of random data corruption.

> Now, another question: assuming the metadata space is corrupted, but I know
> that the crypted space is not, is it possible to ignore the metadata altogether
> (to not produce read errors)?

It depends, see above - it can be done only in the second option.
Cryptsetup does not support it, but in some related issue I already explained the trick.

Milan