On Thu, Dec 29, 2016 at 02:53:25PM +0530, Binoy Jayan wrote: > > When we keep these in dm-crypt and if more than one key is used > (it is actually more than one parts of the original key), > there are more than one cipher instance created - one for each > unique part of the key. Since the crypto requests are modelled > to go through the template ciphers in the order: > > "essiv -> cbc -> aes" > > a particular cipher instance of the IV (essiv in this example) is > responsible to encrypt an entire bigger block. If this bigger block > is to be later split into 512 bytes blocks and then encrypted using > the other cipher instance depending on the following formula: > > key_index = sector & (key_count - 1) This is just a matter of structuring the key for the IV generator. The IV generator's key in this case should be a combination of the key to the underlying CBC plus the set of all keys for the IV generator itself. It should then allocate the required number of tfms as is currently done by crypt_alloc_tfms in dm-crypt. Cheers, -- Email: Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx> Home Page: http://gondor.apana.org.au/~herbert/ PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt -- dm-devel mailing list dm-devel@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/dm-devel
