Re: [dm-crypt] [ANNOUNCE] cryptsetup 1.3.0-rc1 (test release candidate)

[Milan Broz <mbroz@redhat.com>]

On 03/17/2011 02:36 PM, Ludwig Nussel wrote:
> Milan Broz wrote:
>>  * Adds compatible support for loop-AES encryption type in loopaesOpen command.
>>
>>    Linux dm-crypt in 2.6.38 and above supports loop-AES compatible mapping
>>    (including multi-key and special CBC mode, all three modes are supported).
>>
>>    If you have raw loop-AES keyfile (text file with uuencoded per-line keys), you can
>>    access loop-AES volume using
>>      cryptsetup loopaesOpen <device> <name> [--key-size 128] --key-file <key-file>
> 
> Do I gets this right, if multikey is not used loop aes is just
> equivalent to aes-cbc-plain? Couldn't the existing 'create' action
> be extended to just handle the loop-AES multikey mode as well? Ie no
> additional command?

There is additional hashing per line for loopAES keyfile and it warns user
if it detects GPG header. (create will simply map device without warning).

Yes, you can probably map this one one key mode using create command as well,
but using separate command allows version to be autodetected according
to number of lines in keyfile.

I do not want to mix these formats together, non-multikey loopAES mode
is not safe anyway and should not be used.

> Note the IV produced by 'plain' is 32bit while loop-AES uses 64bit
> IIRC. Ie there's an incompatibility for volumes larger than 2TB. So
> you probably need to default to 'aes-cbc-plain64'. I guess that's
> the reason why you introduced plain64 in the first place. :-)

Yes, that is just mistake, there should be plain64, thanks.
That's why I do release candidate to catch these things:)

Milan