[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: minimal LUKS container size



On Wed, Dec 07, 2011 at 01:03:26PM +0100, Milan Broz wrote:
> Minimal size depends on two things:
>  - volume key size
>  - alignment of data area
> 
> Cryptsetup 1.3 by default aligns data to 1MB offset multiple, that's why
> you see this change.
> 
> You can switch to old alignment by using data alignment override, e.g.
> 
> cryptsetup luksFormat -s 128 --align-payload=8
> 
> (So here forcing keysize to 128bit and forcing alignment to 4k offset.
> - vaule is in 512 byte sectors.
> This is perhaps the smallest header possible while still using
> reasonable key size - 1032 x 512 bytes sectors ~ 520kB)
> 
> (But also note that misalignment to flash memory block can have
> some performance effects.)
> 
> Anyway, some example in FAQ would be nice.

Just added this. Tested with 1.3.1 and also 1.4.1 for arc4.

To my surprise, giving alignment --align-payload=1 (or = 2) results 
in a data-area staring at 0x101000, while --align-payload=0 gives 
2MiB offset. Is this rounded up to multiples of 8? I had a brief 
look into the sources but did not find the relevant code. 
The full behaviour should go into the man-page under the 
explanation for "--align-payload". 

Data area size can be 512 bytes (verified with loop-device), but
not 0 bytes, as this gives an ioctl-error on opening.

For cipher, the most extreme I found is RC4 with an 8 bit key.
This can be luksFormat-ed, but fails on opening. This is 
probably a bug when using arc4, as it fails for 128 bit as well.
(tested with 1.4.1). 

Blowfish with 64 bits works though, but is insecure, so added with
a warning. 

Arno
-- 
Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email: arno@xxxxxxxxxxx 
GnuPG:  ID: 1E25338F  FP: 0C30 5782 9D93 F785 E79C  0296 797F 6B50 1E25 338F
----
Cuddly UI's are the manifestation of wishful thinking. -- Dylan Evans

If it's in the news, don't worry about it.  The very definition of 
"news" is "something that hardly ever happens." -- Bruce Schneier 
_______________________________________________
dm-crypt mailing list
dm-crypt@xxxxxxxx
http://www.saout.de/mailman/listinfo/dm-crypt


[DM Devel]     [Fedora Desktop]     [ATA RAID]     [Fedora Marketing]     [Fedora Packaging]     [Fedora SELinux]     [Yosemite News]     [Yosemite Photos]     [KDE Users]     [Fedora Tools]     [Fedora Docs]

Add to Google Powered by Linux