Re: Filling a device with random data

[Arno Wagner <arno@wagner.name>]

Hi,

/dev/urandom has gotten a lot faster. You should be able to
write the data from it directly to the device without  
the plain dm-crypt mapping in between and still get decent
speed.

That said, you can also zero-overwrite a mapped LUKS
container for pretty much the same level of security.
The method with the plain dm-crypt mapping in between 
is _old_. 

Regards,
Arno

On Wed, Feb 08, 2023 at 22:09:54 CET, David Joaquín Shourabi Porcel wrote:
> Hey there :)
> 
> Section 2.19 of the [FAQ][1] explains how to fill devices with random data using dm-crypt: cryptsetup opens a plain mapping, zeros are written to it and it is closed. If LUKS is set up on the device afterwards, this translates to the following commands:
> 
> ```
> cryptsetup open --type=plain --key-file=/dev/urandom -- /dev/foo temporary
> dd if=/dev/zero of=/dev/mapper/temporary
> cryptsetup close -- temporary
> cryptsetup luksFormat -- /dev/foo
> cryptsetup open -- /dev/foo bar
> # mkfs / pvcreate -- /dev/mapper/bar
> ```
> 
> I would like to skip the first mapping and shorten the procedure as follows:
> 
> ```
> cryptsetup luksFormat -- /dev/foo
> cryptsetup open -- /dev/foo bar
> dd if=/dev/zero of=/dev/mapper/bar
> # mkfs / pvcreate -- /dev/mapper/bar
> ```
> 
> Does filling a device with random data under a separate dm-crypt mapping
> offer any security benefit?
> 
> Kind regards,
> 
> David J. Shourabi Porcel
> 
> 
> [1]: https://gitlab.com/cryptsetup/cryptsetup/-/wikis/FrequentlyAskedQuestions

-- 
Arno Wagner,     Dr. sc. techn., Dipl. Inform.,    Email: arno@wagner.name
GnuPG: ID: CB5D9718  FP: 12D6 C03B 1B30 33BB 13CF  B774 E35C 5FA1 CB5D 9718
----
A good decision is based on knowledge and not on numbers. -- Plato

If it's in the news, don't worry about it.  The very definition of 
"news" is "something that hardly ever happens." -- Bruce Schneier