Re: [dm-crypt] How to compress LUKS2 header?

From: Arno Wagner <arno@wagner.name>
To: dm-crypt@saout.de
Subject: Re: [dm-crypt] How to compress LUKS2 header?
Date: Sat, 28 Dec 2019 01:20:26 +0100	[thread overview]
Message-ID: <20191228002026.GA16546@tansi.org> (raw)
In-Reply-To: <65f0e9b350cd4e9bb418c8d87e4333fe@br.ibm.com>

On Fri, Dec 27, 2019 at 21:46:50 CET, Julio Cesar Faracco - jfaracco@br.ibm.com wrote:
> Thanks for your suggestions, guys...
> 
> Do you have any recommendation to reduce this header size then?
> Imagine 1000 lab machines.. They are taking 20 GB to backup each header.

Your situation becomes clearer ;-)
What I do not quite get is why you have header backups but 
(apparently) no data backups. You usually should do both.

As Milan suggested, you can cut off the header after the last 
used keyslot. In LUKS 1 you could also do some ciper magic
(See FAQ Item 6.13), no idea whether that works with LUKS 2
or whether it is secure for your situation.

Other than that, 20GB is not that much in this day and age. 

Regards,
Arno

> Revert to LUKS v1 type is not a possibility.
> 
> I appreciate your help...
> 
> --
> Julio  Cesar Faracco
> 
>     
> From: dm-crypt <dm-crypt-bounces@saout.de> on behalf of Michael Kjörling <michael@kjorling.se>
> Sent: Friday, December 27, 2019 1:20:11 PM
> To: dm-crypt@saout.de
> Subject: [EXTERNAL] Re: [dm-crypt] How to compress LUKS2 header?
>     
> On 27 Dec 2019 10:56 -0500, from gebser@mousecar.com (ken):
> > Compressing a file is one step in the encryption of that file.  So if
> > your LUKS2 header file is encrypted, it's also already compressed. 
> > Using ZIP on it would yield no further compression.
> 
> No, encryption does not imply compression. Rather, trying to compress
> ciphertext is a largely pointless exercise if the encryption is any
> good in the first place; therefore, _if_ you're going to compress the
> data you're encrypting (keeping in mind that doing so is not always a
> good idea; see compression oracle attacks), then you need to compress
> first, then encrypt, not the other way around.
> 
> I'm pretty sure the LUKS header backup isn't compressed.
> 
> -- 
> Michael Kjörling •  https://urldefense.proofpoint.com/v2/url?u=https-3A__michael.kjorling.se&d=DwIGaQ&c=jf_iaSHvJObTbx-siA1ZOg&r=ZRo7ioNm6-KW9XMwc8-3Aqc6TBVFd8_9yk27A36m0u0&m=rQUoPqXVjthTyHfeJ02oW6vvxq9wwNPVBB1anj-N7kI&s=worTWmhb84zgfP27r3HYCW1CSw9M_93ZnC2rb_81SfQ&e=  • michael@kjorling.se
>  “Remember when, on the Internet, nobody cared that you were a dog?”
> 
> _______________________________________________
> dm-crypt mailing list
> dm-crypt@saout.de
> https://urldefense.proofpoint.com/v2/url?u=https-3A__www.saout.de_mailman_listinfo_dm-2Dcrypt&d=DwIGaQ&c=jf_iaSHvJObTbx-siA1ZOg&r=ZRo7ioNm6-KW9XMwc8-3Aqc6TBVFd8_9yk27A36m0u0&m=rQUoPqXVjthTyHfeJ02oW6vvxq9wwNPVBB1anj-N7kI&s=pg-I-9_hpvWliVyuS2yTJk_kfFNljzWR1YSIUcHluIg&e=
>     
> _______________________________________________
> dm-crypt mailing list
> dm-crypt@saout.de
> https://www.saout.de/mailman/listinfo/dm-crypt

-- 
Arno Wagner,     Dr. sc. techn., Dipl. Inform.,    Email: arno@wagner.name
GnuPG: ID: CB5D9718  FP: 12D6 C03B 1B30 33BB 13CF  B774 E35C 5FA1 CB5D 9718
----
A good decision is based on knowledge and not on numbers. -- Plato

If it's in the news, don't worry about it.  The very definition of 
"news" is "something that hardly ever happens." -- Bruce Schneier