Skip to content

option to get minimal LUKS2 header size

Hey.

This is originally from #764 (comment 1108306653):

IMO, it would be nice if there was an option (or proper documentation) that allows luksFormat to use the minimal possible header size.

So basically:

  • one keyslot only (or possible a switch in the option which allows to specify how many keyslots should fit in)
  • not space (or if this is impossible: the least possible space) for further metadata (JSON, area for re-encryption, etc.)
  • minimal data alignment offset, e.g. just large enough so that it's aligned to a 4096 B sector.

This would of course rule out a number of features (like e.g. re-encryption), so there should be some warnings.

I see at least two use cases:

  • embedded systems where one might want to squeeze out a bit more space, especially when it's anyway clear from the scenario that multiple keyslots, etc. will never happen
  • I found that LUKS containers can be quite nicely used for backups (the data inside can be made quite easily directly accessible).
    Yes I'm aware that without integrity there is no integrity protection, and even with it, there is no protection against replay attacks, but in some cases this might not be needed. E.g. when inside there's a btrfs with crypto strength checksumming algo (though I'm still not really sure whether this gives proper integrity protection or not).

Thanks, Chris.