Re: [dm-crypt] Some questions/clarifications around the LUKS spec

[Milan Broz <gmazyland@gmail.com>]

On 03/14/2016 10:24 PM, Sven Eschenberg wrote:

> Updating a spec needs more than just mentioning something. Esp. changes 
> may not be incompatible to previous revisions. If changes are 
> incompatible, a new version is needed (instead of a simple revision). A 
> change to the list of valid values as well as the change in offset 
> calculation to meet alignment requirements are indeed incompatible to 
> the original specification for the v1 header, like it or not. Thus, by 
> introducing these changes, a new version of the on disk format was 
> introduced and this should have been reflected by reversioning the 
> header as well. Having multiple possible specs for the same 
> magic+version is something one really should not go for.

On-disk format should be backward compatible since cryptsetup 1.0.1,
no change in version is needed.
(But there were bugs - so nobody should use such old versions.)

Algorithm support is always dynamic thing (you can blacklist kernel
module, run in FIPS mode that allows only NIST friendly algorithms...)
So "mandatory" list for LUKS does not make sense in reality.

Offset calculation for keyslot is the same as well ... but reading
that pseudo-algorithm in spec - the slot alignment to 4k diverged
in 1.0 -> 1.0.1 (2005). Clemens probably forgot to update spec here,
so this is IMHO bug in spec (and I missed this).

(Cryptsetup can still open old sector-aligned version - despite this version
was never in any distro.)
 
User data alignment was always read from header, it was never calculated
and I think spec expect it this way.

Milan