Re: Equivalent of --integrity-recalculate

[Milan Broz <gmazyland@gmail.com>]

On 5/10/25 5:51 PM, Marc SCHAEFER wrote:
> Hello,
> 
> If you create a cryptsetup/luks device with integrity with:
> 
>     cryptsetup luksFormat -q --type luks2 --integrity hmac-sha256 $dev
> 
> and then open it:
> 
>     cryptsetup open $dev backup-copy
> 
> you then get, according to lsblk, two additional devices:
> 
>     - backup-copy (the transparently decrypted/encrypting volume)
> 
>     - backup-copy_dif (the integrity device)
> 
> (which is similar, AFAIK, as when you use dm-integrity with LVM)
> 
> If you create an integrity device separately, you get a
> 
>     integritysetup --integrity-recalculate open $dev integrity
> 
> command which allows to recalculate the integrity blocks.
> 
> I don't think cryptsetup has this option (*); is there a way to
> do it anyway?  Or maybe remove the backup-copy_dif and
> re-add it?

No, because such option is not implemented (and never will be) in dm-crypt.

Note, for integritysetup you use dm-integrity, for cryptsetup
dm-integrity only provides metadata space, AEAD encrypton
is performed in dm-crypt above.

Sometimes it is not even possible, AEAD just cannot take
data with wrong authentication tag and fix it.
This is only possible when the integrity is calculated separately.

Milan