particle-os/debian-forge
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

org.osbuild.luks2.format: Support dm-integrity

Browse source 
I've been looking at:
  https://archive.fosdem.org/2018/schedule/event/cryptsetup/attachments/slides/2506/export/events/attachments/cryptsetup/slides/2506/fosdem18_cryptsetup_aead.pdf

And it seems if you want integrity checking, dm-crypt is not enough,
but should be combined with dm-integrity. This allows this by using
the --integrity option with cryptsetup.

It should be noted that the slides above mention that this is marked
experimental in the docs because the existing algorithms usable for
this is a bit slow. Something to be aware of if you want to use this.
This commit is contained in:
Alexander Larsson 2022-04-29 13:24:05 +02:00 • committed by Christian Kellner
parent 061c2012ed
commit 9bbe024ba2
1 changed files with 7 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

7
stages/org.osbuild.luks2.format
View file

@ -115,6 +115,9 @@ SCHEMA_2 = r"""
"sector-size": { "sector-size": {
"description": "Sector size to use", "description": "Sector size to use",
"type": "integer" "type": "integer"
},
"integrity": {
"enum": ["hmac-sha256"]
} }
} }
} }
@ -128,6 +131,7 @@ def main(devices, options):
pbkdf = options["pbkdf"] pbkdf = options["pbkdf"]
cipher = options.get("cipher") cipher = options.get("cipher")
label = options.get("label") label = options.get("label")
integrity = options.get("integrity")
subsystem = options.get("subsystem", "") subsystem = options.get("subsystem", "")
sector_size = options.get("sector-size") sector_size = options.get("sector-size")
path = os.path.join("/dev", device["path"]) path = os.path.join("/dev", device["path"])
@ -150,6 +154,9 @@ def main(devices, options):
if sector_size: if sector_size:
command += ["--sector-size", str(sector_size)] command += ["--sector-size", str(sector_size)]
if integrity:
command += ["--integrity", integrity]
# password base key derivation function parameters # password base key derivation function parameters
command += [ command += [
"--pbkdf", pbkdf["method"], "--pbkdf", pbkdf["method"],