3 ms·
You can perfectly fine divide the block device into a bit smaller chunks so that you can fit a MAC or similar at the end.
by black_knight 10y ago
You can perfectly fine divide the block device into a bit smaller chunks so that you can fit a MAC or similar at the end.
- Titanous 10y agoMy understanding is that in practice this is quite hard to do. As far as I know, none of the mainstream block-layer encryption systems (BitLocker, FileVault, dm-crypt) provide authenticated encryption. Here's a short thread about the problems with adding it to dm-crypt: http://comments.gmane.org/gmane.linux.kernel.device-mapper.dm-crypt/6689 http://comments.gmane.org/gmane.linux.kernel.device-mapper.d... I'm sure you can find more threads if you look around.
- black_knight 10y agoThanks! That’s good to know. Indeed, encryption without authentication is poor security.
- deleted 10y ago[deleted]
- mioelnir 10y agoThis is how FreeBSD's GELI (which has authenticated encryption for blockdevices) did it. For every 4k data block it presented up the stack, it consumed 9 512 sectors on disk. Each of them contained 480 bytes, the rest for MAC. With 4k native drives, this became completely impractical. To keep ratios similar, you would have to present 32k byte devices up the stack, which filesystems have troubles with. Or have 1 MAC sector per data sector or similar, cutting your storage in half.