[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: are cryptoapi and loop-aes compatible

Christopher Schadl wrote:
> On 2002.11.01 11:19 Jari Ruusu wrote:
> > Loop-AES and kerneli.org-cryptoapi use same on-disk format, but
> > userspace
> > tools need different options. To mount AES encrypted volumes created
> > with
> > kerneli.org-cryptoapi in loop-AES, use mount option -o phash=rmd160 or
> > losetup option -H rmd160, and specify cipher name as AES128, AES192 or
> > AES256.
> 
> I've been trying to access some of my old data encrypted with cryptoapi
> 2.4.7.0 (compiled with the loop IV-mode patch) and while I am able to
> mount the encrypted image by passing -o phash=rmd160 to mount, the data
> contained on the filesystem is unreadable, no doubt due to the
> differences in block-size values.  Is it possible to mount data
> encrypted with cryptoapi 2.4.x.x with loop-aes by passing an 'offset'
> or 'blocksize' option to mount?

I quickly looked at kerneli.org-cryptoapi-2.4.7.0 and if you specifically
did not ask (./configure --enable-iv-mode-sector) for 512-byte-IV, it
defaulted to time-bomb-IV format. Loop-AES does not read the time-bomb-IV
format.

To read your old data, I suggest you use old 2.4.7 (or whatever) kernel and
losetup that was used to create that on-disk format. Something like this:

    losetup -e aes -k 128 /dev/loop0 /dev/hda999
    mount -t ext2 /dev/loop0 /mnt
    umount /mnt
    dd if=/dev/loop0 bs=64k | aespipe -e AES128 -T | dd of=/dev/hda999 bs=64k conv=notrunc
    losetup -d /dev/loop0
    sync

Above mount and umount are required to set the soft block size to correct
value. That should convert most of the data to 512-byte-IV loop-AES format.
Only few bits of file system superblock _may_ be corrupted as is usual for
time-bomb-IV format. If it breaks, you get to keep both pieces. Care to
guess why it is called time-bomb-IV format?

Aespipe userspace program is available here:

    http://loop-aes.sourceforge.net/aespipe-v2.0a.tar.bz2
    http://loop-aes.sourceforge.net/aespipe-v2.0a.tar.bz2.sign

Regards,
Jari Ruusu <jari.ruusu@pp.inet.fi>

-
Linux-crypto:  cryptography in and on the Linux system
Archive:       http://mail.nl.linux.org/linux-crypto/