Live data from Hacker News

Cryptsetup 2.0.0 introduces new on-disk LUKS2 format

kernel.org

1–10 of 40 posts

Re: Cryptsetup 2.0.0 introduces new on-disk LUKS2 format

#4
Section regarding the format:

    LUKS2 format and features
    ~~~~~~~~~~~~~~~~~~~~~~~~~
    The LUKS2 is an on-disk storage format designed to provide simple key
    management, primarily intended for Full Disk Encryption based on dm-crypt.

    The LUKS2 is inspired by LUKS1 format and in some specific situations (most
    of the default configurations) can be converted in-place from LUKS1.
 
    The LUKS2 format is designed to allow future updates of various
    parts without the need to modify binary structures and internally
    uses JSON text format for metadata. Compilation now requires the json-c library
    that is used for JSON data processing.
 
    On-disk format provides redundancy of metadata, detection
    of metadata corruption and automatic repair from metadata copy.
 
    NOTE: For security reasons, there is no redundancy in keyslots binary data
    (encrypted keys) but the format allows adding such a feature in future.
 
    NOTE: to operate correctly, LUKS2 requires locking of metadata.
    Locking is performed by using flock() system call for images in file
    and for block device by using a specific lock file in /run/lock/cryptsetup.
 
    This directory must be created by distribution (do not rely on internal
    fallback). For systemd-based distribution, you can simply install
    scripts/cryptsetup.conf into tmpfiles.d directory.
 
    For more details see LUKS2-format.txt and LUKS2-locking.txt in the docs
    directory. (Please note this is just overview, there will be more formal
    documentation later.)

Re: Cryptsetup 2.0.0 introduces new on-disk LUKS2 format

#7
post #4

Section regarding the format: LUKS2 format and features ~~~~~~~~~~~~~~~~~~~~~~~~~ The LUKS2 is an on-disk storage format designed to provide simple key management, primarily intended for Full Disk Encryption based on dm-crypt. The LUKS2 is inspired by LUKS1 format and in some specific situations (most of the default configurations) can be converted in-place from LUKS1. The LUKS2 format is designed to allow future upd…

[deleted]

Re: Cryptsetup 2.0.0 introduces new on-disk LUKS2 format

#8
post #6

Doesn't solve my most important problem with LUKS: Allowing Trim passthrough on SSDs without impacting vulnerability. Also, why use json for meta-data instead of simple C Structs? No human is supposed to read this kind of data anyways.

Likely for easier future extensions to the metadata without requiring prior agreement among all implementations about how things are laid out.

Re: Cryptsetup 2.0.0 introduces new on-disk LUKS2 format

#9
post #4

Section regarding the format: LUKS2 format and features ~~~~~~~~~~~~~~~~~~~~~~~~~ The LUKS2 is an on-disk storage format designed to provide simple key management, primarily intended for Full Disk Encryption based on dm-crypt. The LUKS2 is inspired by LUKS1 format and in some specific situations (most of the default configurations) can be converted in-place from LUKS1. The LUKS2 format is designed to allow future upd…

> JSON text format for metadata

It seems like it could be better to use some easier to parse binary format that allows the same flexibility that json does, like cbor/msgpack/bson.

Using JSON here is a very strange choice.

Re: Cryptsetup 2.0.0 introduces new on-disk LUKS2 format

#10
post #9
post #4

Section regarding the format: LUKS2 format and features ~~~~~~~~~~~~~~~~~~~~~~~~~ The LUKS2 is an on-disk storage format designed to provide simple key management, primarily intended for Full Disk Encryption based on dm-crypt. The LUKS2 is inspired by LUKS1 format and in some specific situations (most of the default configurations) can be converted in-place from LUKS1. The LUKS2 format is designed to allow future upd…

> JSON text format for metadata It seems like it could be better to use some easier to parse binary format that allows the same flexibility that json does, like cbor/msgpack/bson. Using JSON here is a very strange choice.

At least it's not XML.
Post reply on HN