Re: luks2 + integrity + discard

[Milan Broz <gmazyland@gmail.com>]

On 7/20/26 10:36 PM, Piergiorgio Sartor wrote:
>> Discard (TRIM) is supported for dm-integrity
>> standalone mode. It is also supported for dm-crypt
>> standalone.
>>
>> It is not supported for stacked dm-crypt over dm-integrity
>> (In authenticated encryption mode where dm-integrity only provides
>> interleaved metadata sectors for dm-crypt.)
> 
> Thanks for the answer.
> 
> I was curious about the technical reason
> for this.
> Why the stacked mode should not made
> possible the discard.
> Is this because they're "interleaved"?
> Could explain or point out to some
> explanation of what is intended with
> "interleaved"?

That is the main reason, you basically cannot trim a continuous region
as sectors are interleaved.

The second reason security - discard in dm-integrity standalone
mode is not secure (you can trim a region to remove real data
and it will not report integrity errors).

The dm-integrity idea (as I initially planned) was to implement
temporary solution to emulate sector+metadata to allow authenticated
encryption.

Once hardware itself can provide such configuration, discard will
work natively (see inline mode).

Unfortunately, only a very few enterprise drives support it
(even if it is basically only about proper SSD firmware).

...
> I mean, SSD are more and more common,
> giving up discard seems a bit of a problem.

Then do not use authenticated encryption using dm-integrity.
Security is not for free.

Milan