mjhjmtu

I'm working on dm-crypt utilizing cryptsetup. I'm interested to understand if it's using a fixed block dimension to encrypt files.

I explain it better: I created a LUKS envelop, formatted it with luksFormat, then open and mounted in file system.

Then I normally write files in that encrypted folder. I want to understand if I write 8 Kb file there is the possibility that dm-crypt encrypt it in blocks of fixed dimensions and in case there is a way to modify this block dimension??

|-----------------------------------------------|
|+ 8Kb +|
|-----------------------------------------------|
| b1 | b2 | b3 | | | | bn |
| | | | | | | |
--------------------------------------------------

Are you talking about the blocksize used by the cipher? Cryptsetup uses block ciphers, often with a 16 byte blocksize. Changing the cipher might change the blocksize, see /proc/crypto for available ciphers & details, and man cryptsetup.

• 
  

  Cryptsetup has a fixed blocksize, 512 bytes, here's a little from it's FAQ:

  
  
  

  
  

  2.18 Is there a concern with 4k Sectors?

  
  
  

  Not from dm-crypt itself. Encryption will be done in 512B blocks, but if the partition and filesystem are aligned correctly and the filesystem uses multiples of 4kiB as block size, the dm-crypt layer will just process 8 x 512B = 4096B at a time with negligible overhead. LUKS does place data at an offset, which is 2MiB per default and will not break alignment. See also Item 6.12 of this FAQ for more details. Note that if your partition or filesystem is misaligned, dm-crypt can make the effect worse though.

  
  

  
  
  

  Also mentioned in 5.16:

  
  
  

  
  

  There is a potential security issue with XTS mode and large blocks.
  LUKS and dm-crypt always use 512B blocks and the issue does not
  apply.

  
  

  
  


• 
  

  Might also be interested in this closed cryptsetup issue (#150) Add dm-crypt support for larger encryption sector (block) size:

  
  
  

  
  

  Comment by chriv... on 2013-11-07 11:32:05:

  
  
  

  I would be very interested in this. It turns out, there are many embedded-type systems with on-board crypto accelerators, that fail to perform adequately when given small blocks to work with. Examples include mv_cesa, which is found in so many home NASes these days (all the orion/kirkwood boards, at least. This includes most of Synology and QNaps offerings)

  
  
  

  Milan Broz @mbroz commented 5 months ago - Owner:

  
  
  

  The sector size option is in kernel 4.12 but will be supported only (optionally) in LUKS2.