On Wed, Dec 07, 2011 at 01:03:26PM +0100, Milan Broz wrote: > Minimal size depends on two things: > - volume key size > - alignment of data area > > Cryptsetup 1.3 by default aligns data to 1MB offset multiple, that's why > you see this change. > > You can switch to old alignment by using data alignment override, e.g. > > cryptsetup luksFormat -s 128 --align-payload=8 > > (So here forcing keysize to 128bit and forcing alignment to 4k offset. > - vaule is in 512 byte sectors. > This is perhaps the smallest header possible while still using > reasonable key size - 1032 x 512 bytes sectors ~ 520kB) > > (But also note that misalignment to flash memory block can have > some performance effects.) > > Anyway, some example in FAQ would be nice. Just added this. Tested with 1.3.1 and also 1.4.1 for arc4. To my surprise, giving alignment --align-payload=1 (or = 2) results in a data-area staring at 0x101000, while --align-payload=0 gives 2MiB offset. Is this rounded up to multiples of 8? I had a brief look into the sources but did not find the relevant code. The full behaviour should go into the man-page under the explanation for "--align-payload". Data area size can be 512 bytes (verified with loop-device), but not 0 bytes, as this gives an ioctl-error on opening. For cipher, the most extreme I found is RC4 with an 8 bit key. This can be luksFormat-ed, but fails on opening. This is probably a bug when using arc4, as it fails for 128 bit as well. (tested with 1.4.1). Blowfish with 64 bits works though, but is insecure, so added with a warning. Arno -- Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email: arno@xxxxxxxxxxx GnuPG: ID: 1E25338F FP: 0C30 5782 9D93 F785 E79C 0296 797F 6B50 1E25 338F ---- Cuddly UI's are the manifestation of wishful thinking. -- Dylan Evans If it's in the news, don't worry about it. The very definition of "news" is "something that hardly ever happens." -- Bruce Schneier _______________________________________________ dm-crypt mailing list dm-crypt@xxxxxxxx http://www.saout.de/mailman/listinfo/dm-crypt
