From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <ldarby@tuffmail.com>
Received: from mail.saout.de ([127.0.0.1])
 by localhost (mail.saout.de [127.0.0.1]) (amavisd-new, port 10024)
 with ESMTP id 2QvGmfxrNkbo for <dm-crypt@saout.de>;
 Tue, 12 Jul 2011 00:11:16 +0200 (CEST)
Received: from fallback-in2.mxes.net (fallback-out2.mxes.net [216.86.168.191])
 by mail.saout.de (Postfix) with ESMTP
 for <dm-crypt@saout.de>; Tue, 12 Jul 2011 00:11:16 +0200 (CEST)
Received: from mxout-07.mxes.net (mxout-07.mxes.net [216.86.168.182])
 by fallback-in1.mxes.net (Postfix) with ESMTP id 3621C2FDBDF
 for <dm-crypt@saout.de>; Mon, 11 Jul 2011 18:03:17 -0400 (EDT)
Received: from home.eagach.dyndns.org (unknown [81.187.127.120])
 (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
 (No client certificate requested)
 by smtp.mxes.net (Postfix) with ESMTPSA id 47D2722E257
 for <dm-crypt@saout.de>; Mon, 11 Jul 2011 18:03:14 -0400 (EDT)
Date: Mon, 11 Jul 2011 23:03:12 +0100
From: Laurence Darby <ldarby@tuffmail.com>
Message-Id: <20110711230312.9833b94d.ldarby@tuffmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Subject: [dm-crypt] Encrypted Raid1 or Raid 1 of encrypted devices?
List-Id: <dm-crypt.saout.de>
List-Unsubscribe: <http://www.saout.de/mailman/options/dm-crypt>,
 <mailto:dm-crypt-request@saout.de?subject=unsubscribe>
List-Archive: <http://www.saout.de/pipermail/dm-crypt>
List-Post: <mailto:dm-crypt@saout.de>
List-Help: <mailto:dm-crypt-request@saout.de?subject=help>
List-Subscribe: <http://www.saout.de/mailman/listinfo/dm-crypt>,
 <mailto:dm-crypt-request@saout.de?subject=subscribe>
To: dm-crypt@saout.de

Hello,

I have 2 disks currently as a RAID1, and want to encrypt it.  I've
done several tests with loopback devices, and found that I can either
create a raid1 with the raw devices, and then encrypt the /dev/md
device, eg:

losetup /dev/loop1 /tmp/a
losetup /dev/loop2 /tmp/b

mdadm --create /dev/md3 --level=1 /dev/loop1 /dev/loop2 --raid-devices=2

cryptsetup luksFormat /dev/md3
cryptsetup luksOpen /dev/md3 md3


or instead encrypt each device, and then make the 2 encrypted devices
into a raid, eg:

losetup /dev/loop3 /tmp/c
losetup /dev/loop4 /tmp/d

cryptsetup luksFormat /dev/loop3
cryptsetup luksFormat /dev/loop4

cryptsetup luksOpen /dev/loop3 data3
cryptsetup luksOpen /dev/loop4 data4

mdadm --create /dev/md4 --level=1 /dev/mapper/data3 /dev/mapper/data4
--raid-devices=2


Is there a recommended way to do this?

I've read the FAQ, especially the part about bad RAM, how single bit
flip errors get amplified - would that mean encrypting each disk
separately is safer, because a bit flip error would be only be copied
to only one device instead of both?  If that happened and a
verification test spotted it, I could remove each device in turn to
find which has the corruption, and repair it.  I am planning on running
the full set of RAM tests anyway.  Is there any reason not to encrypt
each device separately, or any other general advice here?

Thanks,
Laurence