[dm-crypt] cryptsetup alignment

[dm-crypt] cryptsetup alignment

[Christoph Anton Mitterer]

[-- Attachment #1: Type: text/plain, Size: 984 bytes --]

Hi Milan, et al.

Can I find out why cryptsetup created my LUKS devices with a payload
offset of 4096?
I mean these are 512B sectors right?... I though all tools would
nowadays align to 1 MiB  but that would be 2048 S.

The only possible reason I could see would be the following:
Topology
physical disc   ->
MBR partition /dev/sda1 at 2048S   ->
LVM PV on /dev/sda1 with alignment to 2048S    ->
LUKS on an LV on that PV with 4096S

So the data of the LV starts at 4096S which is 2 MiB.
The extent size of the VG is 4 MiB.

So when LUKS uses another 4096S (aka 2MiM).. then the (e.g.) filesystem
on top of LUKS will not only be aligned to the blocks of the disk (even
to any potential 4K disk blocks)... but also to the physical extents of
the LVM...


Is it _really_ that smart that it auto detected this and also included
the LVM's PE size into it's calculations?

If so please warn me to take a seat before I read your "yes"... ;-)


Thanks,
Chris.

[-- Attachment #2: smime.p7s --]
[-- Type: application/x-pkcs7-signature, Size: 5165 bytes --]

Re: [dm-crypt] cryptsetup alignment

[Milan Broz]

On 29.6.2013 5:21, Christoph Anton Mitterer wrote:
> Hi Milan, et al.
>
> Can I find out why cryptsetup created my LUKS devices with a payload
> offset of 4096?
> I mean these are 512B sectors right?... I though all tools would
> nowadays align to 1 MiB  but that would be 2048 S.

If there is enough space for keyslots then it is 1MiB.

If 1MiB is too small, it uses multiple of default alignment, here 2MiB
(See LUKS design document for exact info how keyslot is used.)

I am almost sure you used XTS with 512bit key, that's exactly this case
- 1MiB is not enough for it.

Try to use 256b key for XTS (e.g. default) and you will get 2048s.

(BTW this is one of the reason we stick with 256bit XTS -> AES128
to not increase LUKS keyslots size. For other reasond please seach
this list - this discussion was surely here.)

> Is it _really_ that smart that it auto detected this and also included
> the LVM's PE size into it's calculations?

No. Nothing is so smart as LVM :-]
It is just plain round up to multiple of requested (default) alignment.

Milan

Re: [dm-crypt] cryptsetup alignment

[Christoph Anton Mitterer]

[-- Attachment #1: Type: text/plain, Size: 669 bytes --]

On Sat, 2013-06-29 at 10:47 +0200, Milan Broz wrote:
> I am almost sure you used XTS with 512bit key, that's exactly this case
> - 1MiB is not enough for it.
Ah I see... yes I used 512 bit key

If 8 512bit keys don't fit in the 1MiB then... wouldn't it make sense to
_generally_ align to 4096S? ... I mean now that we have
cryptsetup-reencrypt (which is awesome by the way)... and people can
(AFAIU) also change their ciphers/modes to something larger?


> > Is it _really_ that smart that it auto detected this and also included
> > the LVM's PE size into it's calculations?
> No.
What a pity... that would have been so awesome ;-)


Thanks,
Chris.

[-- Attachment #2: smime.p7s --]
[-- Type: application/x-pkcs7-signature, Size: 5113 bytes --]