Disabling integrity metadata verification (was: Equivalent of --integrity-recalculate)

[Marc SCHAEFER <schaefer@alphanet.ch>]

Hello,

Thank you for this insight:

On Sat, May 10, 2025 at 06:18:18PM +0200, Milan Broz wrote:
> Note, for integritysetup you use dm-integrity, for cryptsetup
> dm-integrity only provides metadata space, AEAD encrypton
> is performed in dm-crypt above.

So, if I understand well, integrity with cryptsetup is implemented with a HMAC
that needs cleartext data (just before encryption) and produce hashed-signed
integrity data that protects against tampering and is not fixable by an
attacker (resistant to voluntary corruption).

Where if I create a dm-integrity layer with a luks crypted volume on top, I get
integrity, but an attacker can modify the crypted data and the hash easily
(only resistant to accidental corruption).

Now, another question: assuming the metadata space is corrupted, but I know
that the crypted space is not, is it possible to ignore the metadata altogether
(to not produce read errors)?

Thank you.