Encrypting data written to an LVM snapshot with a different key
Clash Royale CLAN TAG#URR8PPP
I have the following requirements:
- I have an LVM volume
A, encrypted with keyK1using LUKS. - I need to make a copy-on-write snapshot of
Asuch that- Writes to
Awill continue to be encrypted underK1 - Writes to the snapshot will be encrypted under
K2, which is different fromK1.
- Writes to
The use case is to allow the snapshot to be securely deleted by deleting the encryption key.
Is this possible?
lvm luks snapshot
asked Dec 24 '18 at 3:19
Demi
30537
add a comment |
I have the following requirements:
- I have an LVM volume
A, encrypted with keyK1using LUKS. - I need to make a copy-on-write snapshot of
Asuch that- Writes to
Awill continue to be encrypted underK1 - Writes to the snapshot will be encrypted under
K2, which is different fromK1.
- Writes to
The use case is to allow the snapshot to be securely deleted by deleting the encryption key.
Is this possible?
lvm luks snapshot
asked Dec 24 '18 at 3:19
Demi
30537
add a comment |
I have the following requirements:
- I have an LVM volume
A, encrypted with keyK1using LUKS. - I need to make a copy-on-write snapshot of
Asuch that- Writes to
Awill continue to be encrypted underK1 - Writes to the snapshot will be encrypted under
K2, which is different fromK1.
- Writes to
The use case is to allow the snapshot to be securely deleted by deleting the encryption key.
Is this possible?
lvm luks snapshot
asked Dec 24 '18 at 3:19
Demi
30537
I have the following requirements:
- I have an LVM volume
A, encrypted with keyK1using LUKS. - I need to make a copy-on-write snapshot of
Asuch that- Writes to
Awill continue to be encrypted underK1 - Writes to the snapshot will be encrypted under
K2, which is different fromK1.
- Writes to
The use case is to allow the snapshot to be securely deleted by deleting the encryption key.
Is this possible?
lvm luks snapshot
lvm luks snapshot
asked Dec 24 '18 at 3:19
Demi
30537
asked Dec 24 '18 at 3:19
Demi
30537
asked Dec 24 '18 at 3:19
Demi
30537
asked Dec 24 '18 at 3:19
Demi
30537
asked Dec 24 '18 at 3:19
Demi
30537
30537
add a comment |
add a comment |
1 Answer
1
active
oldest
votes
No, it is not possible to change the LUKS encryption key when making an LVM snapshot.
LUKS is unaware of LVM, so this would be no different than cloning a partition and expecting to be able to change the encryption key.
Now, you MAY be able to achieve your goal if you flip LVM and LUKS. It's a complex setup that goes something like this:
- Create multiple LUKS containers in partitions, each with a different key, of course.
- Create an LVM volume group which uses the unlocked LUKS containers as physical volumes.
- When you create logical volumes, specify which physical volume to use; This will determine which LUKS key is used for the logical volume.
- When you create a snapshot, specify a different physical volume; This means writes to this volume would be encrypted with a different LUKS key.
answered Dec 24 '18 at 5:52
Emmanuel Rosa
3,0551612
add a comment |
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "106"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f490705%2fencrypting-data-written-to-an-lvm-snapshot-with-a-different-key%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
No, it is not possible to change the LUKS encryption key when making an LVM snapshot.
LUKS is unaware of LVM, so this would be no different than cloning a partition and expecting to be able to change the encryption key.
Now, you MAY be able to achieve your goal if you flip LVM and LUKS. It's a complex setup that goes something like this:
- Create multiple LUKS containers in partitions, each with a different key, of course.
- Create an LVM volume group which uses the unlocked LUKS containers as physical volumes.
- When you create logical volumes, specify which physical volume to use; This will determine which LUKS key is used for the logical volume.
- When you create a snapshot, specify a different physical volume; This means writes to this volume would be encrypted with a different LUKS key.
answered Dec 24 '18 at 5:52
Emmanuel Rosa
3,0551612
add a comment |
No, it is not possible to change the LUKS encryption key when making an LVM snapshot.
LUKS is unaware of LVM, so this would be no different than cloning a partition and expecting to be able to change the encryption key.
Now, you MAY be able to achieve your goal if you flip LVM and LUKS. It's a complex setup that goes something like this:
- Create multiple LUKS containers in partitions, each with a different key, of course.
- Create an LVM volume group which uses the unlocked LUKS containers as physical volumes.
- When you create logical volumes, specify which physical volume to use; This will determine which LUKS key is used for the logical volume.
- When you create a snapshot, specify a different physical volume; This means writes to this volume would be encrypted with a different LUKS key.
answered Dec 24 '18 at 5:52
Emmanuel Rosa
3,0551612
add a comment |
No, it is not possible to change the LUKS encryption key when making an LVM snapshot.
LUKS is unaware of LVM, so this would be no different than cloning a partition and expecting to be able to change the encryption key.
Now, you MAY be able to achieve your goal if you flip LVM and LUKS. It's a complex setup that goes something like this:
- Create multiple LUKS containers in partitions, each with a different key, of course.
- Create an LVM volume group which uses the unlocked LUKS containers as physical volumes.
- When you create logical volumes, specify which physical volume to use; This will determine which LUKS key is used for the logical volume.
- When you create a snapshot, specify a different physical volume; This means writes to this volume would be encrypted with a different LUKS key.
answered Dec 24 '18 at 5:52
Emmanuel Rosa
3,0551612
No, it is not possible to change the LUKS encryption key when making an LVM snapshot.
LUKS is unaware of LVM, so this would be no different than cloning a partition and expecting to be able to change the encryption key.
Now, you MAY be able to achieve your goal if you flip LVM and LUKS. It's a complex setup that goes something like this:
- Create multiple LUKS containers in partitions, each with a different key, of course.
- Create an LVM volume group which uses the unlocked LUKS containers as physical volumes.
- When you create logical volumes, specify which physical volume to use; This will determine which LUKS key is used for the logical volume.
- When you create a snapshot, specify a different physical volume; This means writes to this volume would be encrypted with a different LUKS key.
answered Dec 24 '18 at 5:52
Emmanuel Rosa
3,0551612
answered Dec 24 '18 at 5:52
Emmanuel Rosa
3,0551612
answered Dec 24 '18 at 5:52
Emmanuel Rosa
3,0551612
answered Dec 24 '18 at 5:52
Emmanuel Rosa
3,0551612
3,0551612
add a comment |
add a comment |
Thanks for contributing an answer to Unix & Linux Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Some of your past answers have not been well-received, and you're in danger of being blocked from answering.
Please pay close attention to the following guidance:
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f490705%2fencrypting-data-written-to-an-lvm-snapshot-with-a-different-key%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
