[dm-crypt] cryptsetup from aes-cbc to aes-xts

[dm-crypt] cryptsetup from aes-cbc to aes-xts

[xxiao8]

I had a one liner change in my cryptsetup script (see below), as long as 
the key-file is the same, I can keep using the content on the 
hard-drive, which is a surprise to me. Doesn't switch-to-aes-xts-plain64 
mandate a reformat of the hard drive? am I missing something?


Changing from
cryptsetup -v -c "aes-cbc-essiv:sha256" --key-size 256 --key-file 
/etc/keys/sda1.key luksFormat --use-random /dev/sda1

to
cryptsetup -v -c "aes-xts-plain64" --hash sha256 --key-size 512 
--key-file /etc/keys/sda1.key luksFormat --use-random /dev/sda1

Thanks for your help,

xxiao

Re: [dm-crypt] cryptsetup from aes-cbc to aes-xts

[Arno Wagner]

You do not need to format the disk, you just need to luksFormat
the LUKS container (i.e. full disk, partition or loop-file). 
Your LUKS container here is /dev/sda1 and you are 
luks(re)Formatting it with the lines you give.

Regards,
Arno

On Thu, Oct 29, 2015 at 23:28:58 CET, xxiao8 wrote:
> I had a one liner change in my cryptsetup script (see below), as
> long as the key-file is the same, I can keep using the content on
> the hard-drive, which is a surprise to me. Doesn't
> switch-to-aes-xts-plain64 mandate a reformat of the hard drive? am I
> missing something?
> 
> 
> Changing from
> cryptsetup -v -c "aes-cbc-essiv:sha256" --key-size 256 --key-file
> /etc/keys/sda1.key luksFormat --use-random /dev/sda1
> 
> to
> cryptsetup -v -c "aes-xts-plain64" --hash sha256 --key-size 512
> --key-file /etc/keys/sda1.key luksFormat --use-random /dev/sda1
> 
> Thanks for your help,
> 
> xxiao
> 
> _______________________________________________
> dm-crypt mailing list
> dm-crypt@saout.de
> http://www.saout.de/mailman/listinfo/dm-crypt

-- 
Arno Wagner,     Dr. sc. techn., Dipl. Inform.,    Email: arno@wagner.name
GnuPG: ID: CB5D9718  FP: 12D6 C03B 1B30 33BB 13CF  B774 E35C 5FA1 CB5D 9718
----
A good decision is based on knowledge and not on numbers. -- Plato

If it's in the news, don't worry about it.  The very definition of 
"news" is "something that hardly ever happens." -- Bruce Schneier

Re: [dm-crypt] cryptsetup from aes-cbc to aes-xts

[Michael Kjörling]

On 29 Oct 2015 17:28 -0500, from xxiao8@fosiao.com (xxiao8):
> I had a one liner change in my cryptsetup script (see below), as
> long as the key-file is the same, I can keep using the content on
> the hard-drive, which is a surprise to me. Doesn't
> switch-to-aes-xts-plain64 mandate a reformat of the hard drive? am I
> missing something?

What do you mean by "keep using the content"?

If the luksFormat is run while the container is unmounted, I don't see
how you could retain access to the encrypted content in any meaningful
way, even if you were to use the same algorithm, unless you are using
an external LUKS header; even if you use the same key file and/or
passphrase, the luksFormat causes the header to be rewritten with a
different encryption key, which will all but ensure that the data will
no longer make any sense whatsoever.


> Changing from
> cryptsetup -v -c "aes-cbc-essiv:sha256" --key-size 256 --key-file
> /etc/keys/sda1.key luksFormat --use-random /dev/sda1
> 
> to
> cryptsetup -v -c "aes-xts-plain64" --hash sha256 --key-size 512
> --key-file /etc/keys/sda1.key luksFormat --use-random /dev/sda1

-- 
Michael Kjörling • https://michael.kjorling.se • michael@kjorling.se
                 “People who think they know everything really annoy
                 those of us who know we don’t.” (Bjarne Stroustrup)