Re: [dm-crypt] Some questions/clarifications around the LUKS spec

[Sven Eschenberg <sven@whgl.uni-frankfurt.de>]

Am 14.03.2016 um 23:27 schrieb Milan Broz:
> On 03/14/2016 10:24 PM, Sven Eschenberg wrote:
>
>> Updating a spec needs more than just mentioning something. Esp. changes
>> may not be incompatible to previous revisions. If changes are
>> incompatible, a new version is needed (instead of a simple revision). A
>> change to the list of valid values as well as the change in offset
>> calculation to meet alignment requirements are indeed incompatible to
>> the original specification for the v1 header, like it or not. Thus, by
>> introducing these changes, a new version of the on disk format was
>> introduced and this should have been reflected by reversioning the
>> header as well. Having multiple possible specs for the same
>> magic+version is something one really should not go for.
>
> On-disk format should be backward compatible since cryptsetup 1.0.1,
> no change in version is needed.
> (But there were bugs - so nobody should use such old versions.)

Yes and no. It seems the spec purposefully decided to offer a fixed list 
(of ciphers/modes) to make alternative implementations possible. AFAIK 
none really exists (in the public domain) and since the old reference 
implementation already allowed diverging from the spec it did not really 
adhere it either. Any other implementationhonoring the spec before the 
xts updates could legitimately consider all headers with unlisted 
ciphers invalid and refuse to work (for safety). So there would no real 
harm be done, yet it would have been better to make this change clear by 
changing the version - afterall there's a 16-bit value and massive 
changes could still change the magic string for safety. (in example your 
plans for v2)

> Algorithm support is always dynamic thing (you can blacklist kernel
> module, run in FIPS mode that allows only NIST friendly algorithms...)
> So "mandatory" list for LUKS does not make sense in reality.

As I read the LUKS spec it is not limited to the stock kernel crypto 
modules, in practise no alternatives showed up so far though. Example: 
Imagine the crypto is done externally by a crypto device that is tied to 
your box by RDMA and offers a cipher which it names rijndael. So an 
implementation that sets up this device would map the name rijndael to 
aes and you could still use the encrypted device with any different 
kernel. I think limiting the list of ciphers and modes was for full 
portability, which makes sense.

>
> Offset calculation for keyslot is the same as well ... but reading
> that pseudo-algorithm in spec - the slot alignment to 4k diverged
> in 1.0 -> 1.0.1 (2005). Clemens probably forgot to update spec here,
> so this is IMHO bug in spec (and I missed this).
>
> (Cryptsetup can still open old sector-aligned version - despite this version
> was never in any distro.)

The question though is, would that still hold true the other way round 
for old cryptsetup versions (and alternative implementations) prior to 
the xts spec update?

>
> User data alignment was always read from header, it was never calculated
> and I think spec expect it this way.

I think the spec is not clear on this, it suggests the offsets are 
stored for safety. It does not explicitly state the stored values should 
take precedence, though this is one (sane) possible interpretation. It's 
never to late for an errata to clarify this ;-).

>
> Milan

Regards

-Sven