Re: [dm-crypt] cryptsetup-reencode: LUKS-${UUID}.new is too small

[Milan Broz <gmazyland@gmail.com>]

On 03/13/2014 02:31 AM, Arno Wagner wrote:
>> If you imagine disc sectors/blocks as a stack, growing/shrinking 
>> adds/removes(or frees) blocks at the top.
> 
> That was my first take also, but the manpage for cryptsetup-
> reencrypt option --reduce-device-size says 
> 
> "This means that last sectors on the original device will be 
> lost, ciphertext data will be effectively shifted by specified 
> number of sectors."

Yes, with --reduce-device-size it reencrypts "backwards" with optional
data shift.

If your fs supports shrinking and you want to be safe, just shrink fs
of twice size of needed LUKS extension (e.g. 8MB and then use 4MB
in reduce size option) and after reencryption just resize to full device.

Or with LVM just enlarge LV by 4MB (but this can fragment LV and
you need free space).

I described some crazy reencrypt operations here
http://asalor.blogspot.cz/2012/08/re-encryption-of-luks-device-cryptsetup.html

but as was already said: it is dangerous, backups are mandatory.

Milan