On 25/09/2019 21:40, .. ink .. wrote:
> I just added an ability to create an authenticated luks2 device in
> zuluCrypt[1] and i am
> wondering why these volumes need to be wiped when created. I made it work by
> looking at how cryptsetup does it but i don't understand why because i
> have so far
> failed to find any documentation about it.
I think it is explained in the referenced paper, we should add a FAQ about it.
Initial wipe recalculates integrity tags - so you can read the device afterward.
If you skip initialization (wipe), integrity tags for all sectors is incorrect
and read will return integrity failure (EILSEQ errno).
In theory, it is not a problem ("do not read what you did not write").
But it reality it cases many programs to fail because it can access device
through page cache. If the *write* is not aligned to a page, page cache tries
to first read content, then update content, and write it back to the device.
But as said above, all read fails because integrity tags are not initialized,
thus even page-unaligned writes can fail.
(I have seen this problem even in programs like mkfs, where it is apparent bug.)
Milan
>
> [1] https://github.com/mhogomchungu/zuluCrypt/issues/134
> _______________________________________________
> dm-crypt mailing list
> dm-crypt@xxxxxxxx
> https://www.saout.de/mailman/listinfo/dm-crypt
>
_______________________________________________
dm-crypt mailing list
dm-crypt@xxxxxxxx
https://www.saout.de/mailman/listinfo/dm-crypt
