cryptsetup from aes-cbc to aes-xts

dm-crypt xxiao8 3 participants 3 messages Oct 29, 2015 – Oct 30, 2015

Share & tools

xxiao8

author

2015-10-29 22:44 UTC #0 lore raw

I had a one liner change in my cryptsetup script (see below), as long as the key-file is the same, I can keep using the content on the hard-drive, which is a surprise to me. Doesn't switch-to-aes-xts-plain64 mandate a reformat of the hard drive? am I missing something?

Changing from
cryptsetup -v -c "aes-cbc-essiv:sha256" --key-size 256 --key-file /etc/keys/sda1.key luksFormat --use-random /dev/sda1

to
cryptsetup -v -c "aes-xts-plain64" --hash sha256 --key-size 512 --key-file /etc/keys/sda1.key luksFormat --use-random /dev/sda1

Thanks for your help,

xxiao

Arno Wagner

2015-10-29 23:32 UTC #1 lore raw

You do not need to format the disk, you just need to luksFormat the LUKS container (i.e. full disk, partition or loop-file). Your LUKS container here is /dev/sda1 and you are luks(re)Formatting it with the lines you give.

Regards,
Arno

Quoted 23 lines · On Thu, Oct 29, 2015 at 23:28:58 CET, xxiao8 wrote:

I had a one liner change in my cryptsetup script (see below), as long as the key-file is the same, I can keep using the content on the hard-drive, which is a surprise to me. Doesn't switch-to-aes-xts-plain64 mandate a reformat of the hard drive? am I missing something?
Changing from
cryptsetup -v -c "aes-cbc-essiv:sha256" --key-size 256 --key-file /etc/keys/sda1.key luksFormat --use-random /dev/sda1
to
cryptsetup -v -c "aes-xts-plain64" --hash sha256 --key-size 512 --key-file /etc/keys/sda1.key luksFormat --use-random /dev/sda1
Thanks for your help,
xxiao
_______________________________________________
dm-crypt mailing list
[email protected]
http://www.saout.de/mailman/listinfo/dm-crypt

Signature · 7 lines

Arno Wagner,     Dr. sc. techn., Dipl. Inform.,    Email: [email protected]
GnuPG: ID: CB5D9718  FP: 12D6 C03B 1B30 33BB 13CF  B774 E35C 5FA1 CB5D 9718
----
A good decision is based on knowledge and not on numbers. -- Plato

If it's in the news, don't worry about it.  The very definition of 
"news" is "something that hardly ever happens." -- Bruce Schneier

Michael Kjörling

2015-10-30 21:39 UTC #2 lore raw

In reply to xxiao8

On 29 Oct 2015 17:28 -0500, from [email protected] (xxiao8):

Quoted 5 lines

I had a one liner change in my cryptsetup script (see below), as long as the key-file is the same, I can keep using the content on the hard-drive, which is a surprise to me. Doesn't switch-to-aes-xts-plain64 mandate a reformat of the hard drive? am I missing something?

What do you mean by "keep using the content"?

If the luksFormat is run while the container is unmounted, I don't see how you could retain access to the encrypted content in any meaningful way, even if you were to use the same algorithm, unless you are using an external LUKS header; even if you use the same key file and/or passphrase, the luksFormat causes the header to be rewritten with a different encryption key, which will all but ensure that the data will no longer make any sense whatsoever.

Quoted 7 lines

Changing from
cryptsetup -v -c "aes-cbc-essiv:sha256" --key-size 256 --key-file /etc/keys/sda1.key luksFormat --use-random /dev/sda1
to
cryptsetup -v -c "aes-xts-plain64" --hash sha256 --key-size 512 --key-file /etc/keys/sda1.key luksFormat --use-random /dev/sda1

Signature · 3 lines

Michael Kjörling • https://michael.kjorling.se • [email protected]
                 “People who think they know everything really annoy
                 those of us who know we don’t.” (Bjarne Stroustrup)