From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <SRS0=WarX=LY=saout.de=dm-crypt-bounces@kernel.org>
X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on
	aws-us-west-2-korg-lkml-1.web.codeaurora.org
X-Spam-Level: 
X-Spam-Status: No, score=-5.1 required=3.0 tests=BAYES_00,DKIM_INVALID,
	DKIM_SIGNED,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SPF_HELO_NONE,
	SPF_PASS,URIBL_BLOCKED,USER_AGENT_SANE_1 autolearn=no autolearn_force=no
	version=3.4.0
Received: from mail.kernel.org (mail.kernel.org [198.145.29.99])
	by smtp.lore.kernel.org (Postfix) with ESMTP id 7F785C11F65
	for <dm-crypt@archiver.kernel.org>; Wed, 30 Jun 2021 09:19:02 +0000 (UTC)
Received: from mail.server123.net (mail.server123.net [78.46.64.186])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(No client certificate requested)
	by mail.kernel.org (Postfix) with ESMTPS id E1F2961D0F
	for <dm-crypt@archiver.kernel.org>; Wed, 30 Jun 2021 09:19:01 +0000 (UTC)
DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org E1F2961D0F
Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=redhat.com
Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=dm-crypt-bounces@saout.de
X-Virus-Scanned: amavisd-new at saout.de
Authentication-Results: mail.server123.net (amavisd-new);
	dkim=pass (1024-bit key) header.d=redhat.com
Received-SPF: Pass (mailfrom) identity=mailfrom; client-ip=216.205.24.124; helo=us-smtp-delivery-124.mimecast.com; envelope-from=okozina@redhat.com; receiver=<UNKNOWN> 
X-Greylist: delayed 306 seconds by postgrey-1.37 at siona; Wed, 30 Jun 2021 11:16:36 CEST
Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [216.205.24.124])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(No client certificate requested)
	by mail.server123.net (Postfix) with ESMTPS
	for <dm-crypt@saout.de>; Wed, 30 Jun 2021 11:16:35 +0200 (CEST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com;
	s=mimecast20190719; t=1625044594;
	h=from:from:reply-to:subject:subject:date:date:message-id:message-id:
	 to:to:cc:mime-version:mime-version:content-type:content-type:
	 content-transfer-encoding:content-transfer-encoding:
	 in-reply-to:in-reply-to:references:references;
	bh=EVeNfY4S3sEomnGHoN4Q5PMMqilLysLYfA7LQJvi0ss=;
	b=JuP2wRg0zguQMBLbNy7mMDj7eAJi4T/IWTVjurK/anKIkjlfzlEOkH3DbgxpvqXApsWPsa
	6szh/sEQ5OQAcd90o01UR4S5IbPldmU6dhun9qr63jiPEuVIZz3Virf0/uJAXS5PDBElSu
	y3IvkS/3zw8JccqTmfm/GLQ1a6eArG4=
Received: from mail-ed1-f70.google.com (mail-ed1-f70.google.com
 [209.85.208.70]) (Using TLS) by relay.mimecast.com with ESMTP id
 us-mta-462-hYwTsbyPNPGB4Emg8Avttg-1; Wed, 30 Jun 2021 05:10:20 -0400
X-MC-Unique: hYwTsbyPNPGB4Emg8Avttg-1
Received: by mail-ed1-f70.google.com with SMTP id r15-20020aa7da0f0000b02903946a530334so779944eds.22
        for <dm-crypt@saout.de>; Wed, 30 Jun 2021 02:10:20 -0700 (PDT)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=1e100.net; s=20161025;
        h=x-gm-message-state:subject:to:references:from:message-id:date
         :user-agent:mime-version:in-reply-to:content-language
         :content-transfer-encoding;
        bh=EVeNfY4S3sEomnGHoN4Q5PMMqilLysLYfA7LQJvi0ss=;
        b=CD9D21GvUlm+hZNbB8jsYBnh1SiNs62Rd2wdhgkQJYyk6n3+zQxwNHBNGelyXwerm2
         eDJoGjF3wcGUMOnaNvIK2Pbc1N1q5PDlERK6qqoN3R6k6cn0j0DG+aLykWpYLAHp9QvJ
         d6HHXgVJixkAW9g7Y0azIQsJnDuHL/yBWqwx4HoGsu8/W41Cz31tTIQHpcCOqWps0irA
         u89lnK3b2Bc1mRtnCp+AcwGUrRW4dAkpM444lnwP+Kv4sGOHY4JcdQOUTQ/kgkrtIq3v
         hqJChd0LeBzZu/vltoj/bcdbQyxgHCltaKSWSYvfoh1nIia5U/OqiyUytvpaxcAPxR6b
         FTDw==
X-Gm-Message-State: AOAM533tjJbjqRbpZR4CfzJjrTqBoXn2hgXiOUJTKcPNgj9h7rMMzwM2
	rGPp17RC4W/gYwKZvmsvnRoCVNinZIIxwI8lYvv5u1PTSureO6M/0eNACZB6Hp1xR/Ywj2HNa0i
	x0pl+12dB21ZrLLEsLxK5VEt0xKGlU0Sn5LoHWCAUqLWBBNMjrn5RjXC3zUw=
X-Received: by 2002:a17:906:31cb:: with SMTP id f11mr34331469ejf.379.1625044219071;
        Wed, 30 Jun 2021 02:10:19 -0700 (PDT)
X-Google-Smtp-Source: ABdhPJzZSYK5lwmXwBXF9yTyCUEHxsfV5tCjbeCbxv6TLx0+b2ZmtgCvMjWQSXeFe2acLB/pq+OMhQ==
X-Received: by 2002:a17:906:31cb:: with SMTP id f11mr34331447ejf.379.1625044218819;
        Wed, 30 Jun 2021 02:10:18 -0700 (PDT)
Received: from mrjust8.localdomain ([83.240.60.136])
        by smtp.gmail.com with ESMTPSA id f20sm7337006ejl.41.2021.06.30.02.10.18
        (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128);
        Wed, 30 Jun 2021 02:10:18 -0700 (PDT)
To: Yoann CONGAL <yoann.congal@smile.fr>, dm-crypt@saout.de
References: <CAMSfU+5R5ZBeVjCkbeqRh33g_rJpZRrygs89zyf59s2Nb7QXrQ@mail.gmail.com>
From: Ondrej Kozina <okozina@redhat.com>
Message-ID: <f733c8c7-ea1b-9acd-3212-df2fca306500@redhat.com>
Date: Wed, 30 Jun 2021 11:10:17 +0200
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101
 Thunderbird/78.11.0
MIME-Version: 1.0
In-Reply-To: <CAMSfU+5R5ZBeVjCkbeqRh33g_rJpZRrygs89zyf59s2Nb7QXrQ@mail.gmail.com>
Authentication-Results: relay.mimecast.com;
	auth=pass smtp.auth=CUSA124A263 smtp.mailfrom=okozina@redhat.com
X-Mimecast-Spam-Score: 0
X-Mimecast-Originator: redhat.com
Content-Language: en-US
Message-ID-Hash: W5PDPSU32HBP2NSOICP74FVESB7OOAPV
X-Message-ID-Hash: W5PDPSU32HBP2NSOICP74FVESB7OOAPV
X-MailFrom: okozina@redhat.com
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-dm-crypt.saout.de-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; suspicious-header
X-Mailman-Version: 3.3.2
Precedence: list
Subject: [dm-crypt] Re: LUKS container creation without device mapper or loop device access
List-Id: <dm-crypt.saout.de>
List-Help: <mailto:dm-crypt-request@saout.de?subject=help>
List-Post: <mailto:dm-crypt@saout.de>
List-Subscribe: <mailto:dm-crypt-join@saout.de>
List-Unsubscribe: <mailto:dm-crypt-leave@saout.de>
Content-Type: text/plain; charset="us-ascii"; format="flowed"
Content-Transfer-Encoding: 7bit

Hi,

On 6/18/21 10:22 AM, Yoann CONGAL wrote:
> 
>  From what I understood of the internals of cryptsetup, it knows how to
> build the LUKS header but rely on the dm-crypt module of the kernel to
> do the actual data encryption. (Please correct me if I'm wrong)

Yes, dm-crypt is usually only necessary to access data when LUKS device 
is activated (unlocked). That said, there are some exceptions. For 
example when crypto backend used in libcryptsetup (or kernel crypto API) 
does not support used cipher/mode for some reason. In that case we 
fallback to use dm-crypt to perform encryption/decryption of LUKS 
keyslots. It also requires root privs in this corner case.

> 
> So, I have two questions :
> * Do you know of a tool that does the full LUKS image (header and
> data) fully in userland? (I did search for it and found nothing)
> * If the above answer is "It does not exist yet", would you be open to
> its inclusion in cryptsetup? My guess is that a tightly managed intern
> may handle this.
With default cipher (aes) you can use new LUKS2 reencryption code for 
that. LUKS2 header (cryptsetup format) can be created fully without need 
to use dm-crypt already, but If you need to encrypt existing data you 
can use following command:

This should work without root privs. It will create separate detached 
LUKS2 header in <new_detached_LUKS2_header>:

cryptsetup reencrypt --encrypt <my_data_file> --header 
<new_detached_LUKS2_header> --disable-locks

For header put in the beginning of the data file you can use:

cryptsetup reencrypt --encrypt <my_data_file> --reduce-device-size 32M 
--disable-locks

just bear in mind that my_data_file must have 32MiB spare space at the 
end (iow there should be no useful data at the end of the file).

With root privs, you can drop --disable-locks parameter and also use 
block devices in place of <my_data_file>.

Look for more information related to online encryption under "reencrypt" 
action of cryptsetup.

Kind regards
Ondrej K.

_______________________________________________
dm-crypt mailing list -- dm-crypt@saout.de
To unsubscribe send an email to dm-crypt-leave@saout.de