Cryptsetup 2.0.0 introduces new on-disk LUKS2 format
1–10 of 40 posts
Re: Cryptsetup 2.0.0 introduces new on-disk LUKS2 format
#2Re: Cryptsetup 2.0.0 introduces new on-disk LUKS2 format
#3Re: Cryptsetup 2.0.0 introduces new on-disk LUKS2 format
#4 LUKS2 format and features
~~~~~~~~~~~~~~~~~~~~~~~~~
The LUKS2 is an on-disk storage format designed to provide simple key
management, primarily intended for Full Disk Encryption based on dm-crypt.
The LUKS2 is inspired by LUKS1 format and in some specific situations (most
of the default configurations) can be converted in-place from LUKS1.
The LUKS2 format is designed to allow future updates of various
parts without the need to modify binary structures and internally
uses JSON text format for metadata. Compilation now requires the json-c library
that is used for JSON data processing.
On-disk format provides redundancy of metadata, detection
of metadata corruption and automatic repair from metadata copy.
NOTE: For security reasons, there is no redundancy in keyslots binary data
(encrypted keys) but the format allows adding such a feature in future.
NOTE: to operate correctly, LUKS2 requires locking of metadata.
Locking is performed by using flock() system call for images in file
and for block device by using a specific lock file in /run/lock/cryptsetup.
This directory must be created by distribution (do not rely on internal
fallback). For systemd-based distribution, you can simply install
scripts/cryptsetup.conf into tmpfiles.d directory.
For more details see LUKS2-format.txt and LUKS2-locking.txt in the docs
directory. (Please note this is just overview, there will be more formal
documentation later.)Re: Cryptsetup 2.0.0 introduces new on-disk LUKS2 format
#5Re: Cryptsetup 2.0.0 introduces new on-disk LUKS2 format
#6Also, why use json for meta-data instead of simple C Structs? No human is supposed to read this kind of data anyways.
Re: Cryptsetup 2.0.0 introduces new on-disk LUKS2 format
#7Section regarding the format: LUKS2 format and features ~~~~~~~~~~~~~~~~~~~~~~~~~ The LUKS2 is an on-disk storage format designed to provide simple key management, primarily intended for Full Disk Encryption based on dm-crypt. The LUKS2 is inspired by LUKS1 format and in some specific situations (most of the default configurations) can be converted in-place from LUKS1. The LUKS2 format is designed to allow future upd…
Re: Cryptsetup 2.0.0 introduces new on-disk LUKS2 format
#8Doesn't solve my most important problem with LUKS: Allowing Trim passthrough on SSDs without impacting vulnerability. Also, why use json for meta-data instead of simple C Structs? No human is supposed to read this kind of data anyways.
Re: Cryptsetup 2.0.0 introduces new on-disk LUKS2 format
#9Section regarding the format: LUKS2 format and features ~~~~~~~~~~~~~~~~~~~~~~~~~ The LUKS2 is an on-disk storage format designed to provide simple key management, primarily intended for Full Disk Encryption based on dm-crypt. The LUKS2 is inspired by LUKS1 format and in some specific situations (most of the default configurations) can be converted in-place from LUKS1. The LUKS2 format is designed to allow future upd…
It seems like it could be better to use some easier to parse binary format that allows the same flexibility that json does, like cbor/msgpack/bson.
Using JSON here is a very strange choice.
Re: Cryptsetup 2.0.0 introduces new on-disk LUKS2 format
#10Section regarding the format: LUKS2 format and features ~~~~~~~~~~~~~~~~~~~~~~~~~ The LUKS2 is an on-disk storage format designed to provide simple key management, primarily intended for Full Disk Encryption based on dm-crypt. The LUKS2 is inspired by LUKS1 format and in some specific situations (most of the default configurations) can be converted in-place from LUKS1. The LUKS2 format is designed to allow future upd…
> JSON text format for metadata It seems like it could be better to use some easier to parse binary format that allows the same flexibility that json does, like cbor/msgpack/bson. Using JSON here is a very strange choice.