Re: [Question] Distinction responsibilities LUKS and dm-crypt

["Michael Kjörling" <michael@kjorling.se>]

On 31 Mar 2022 21:32 +0200, from calestyo@scientia.org (Christoph Anton Mitterer):
> Some people may say that with "plain" /.../
> /.../
> It may have some tiny advantages when using it for temporary devices
> (like temporarily encrypted swap devices).

For that use case I would prefer to say that using LUKS has no added
benefit over a plain dm-crypt mapping, because the key material would
be thrown away on a reboot anyway. (Effectively giving swap the same
largely-emphemeral storage properties as RAM.) You _can_ do the same
thing by reformatting a LUKS container before passing it to swapon(8),
but doing so has no significant benefit that I can see compared to
just re-opening a plain dm-crypt mapping with a key read each time
from /dev/{u,}random and treating any pre-existing data as garbage.

Another use case for plain dm-crypt mappings is when you want to
pre-fill a storage device with random data to conceal which parts are
in use by what's inside a LUKS container: my experience is that it's
much faster to open a dm-crypt mapping with a throwaway key and then
write from /dev/zero through it, than is writing from /dev/{u,}random
to the raw backing device, and absent the key the output of any
competent encryption algorithm _should_ be indistinguishable from
random anyway. But maybe with the up-and-coming changes to
/dev/{u,}random in Linux that'll be subject to change.

-- 
Michael Kjörling • https://michael.kjorling.se • michael@kjorling.se
 “Remember when, on the Internet, nobody cared that you were a dog?”