Re: [stable] dm-crypt: plain64 IV support for -stable?

[Greg KH <greg@kroah.com>]

On Tue, Oct 12, 2010 at 04:04:38PM -0300, Henrique de Moraes Holschuh wrote:
> On Tue, 12 Oct 2010, Greg KH wrote:
> > Which -stable tree?  .27, .32, .35, or any/all of them?  Please be more
> > specific when asking for this in the future.
> 
> Just 2.6.32.  It is already in 2.6.35, and 2.6.27 is too old for it to
> matter.

Ok.

> > > Without it, users of LTS kernels like 2.6.32 are missing important
> > > functionality (as in: might not be able to mount some LUKS volumes
> > > created on newer kernels).
> > 
> > Also note that this patch really looks like a "new feature", not a
> > bugfix or anything that matches up with what
> > Documentation/stable_kernel_rules.txt defines.  So I don't think that it
> > really is something to add to a stable kernel.
> 
> Using "plain" for IVs on block devices with more than 2^32 blocks will cause
> the same IV to be used twice due to roll-over.  This is not a good thing,
> although it might be not bad enough to matter much (or it could be a
> terrible problem.  Someone who groks crypto for real would have to answer
> that).
> 
> One cannot fix "plain", or data after the roll-over point becomes unreadable
> on any already-existing devices.  Thus, a new IV was added with the fix,
> "plain64".
> 
> Distros will probably need to backport this, as userspace and docs are
> already starting to tell users to use aes-xts-plain64 and not aes-xts-plain.
> They will use them in their portable HDs, and then will not be able to read
> them back in various stable distros.   Might as well do it upstream where it
> will benefit everybody...

If they create them in a newer kernel, and then try to use an older
kernel, how would they normally expect them to work?

Yes, I understand your point, but please note that this is a new feature
being added, which is not what the stable tree is for at all.  If it's a
real issue, let the distros know about it, but even then, I doubt they
will care as they don't support such a "use on new, then on old" type
model either.

thanks,

greg k-h