Score:0

Server

Setting up resilient single drive NVMe storage for LUKS encryption

Alojzij Blatnik

12/27/23, 2:40 PM

I would like to set up resilient encrypted storage with single NVMe drive for my laptop and its (encrypted) backup (with SATA housing and SSD drive).

This is what I have at the moment:

SSD -> GPT partitions (unencrypted /boot, EFI, and LUKS) -> LVM -> BTRFS.

I started checking if LUKS has any CRC, so that it wouldn't multiply data corruption, and it seems that it has not. It will create 16 wrong bytes for a single bad bit. I'm interested to know if there's a way to setup integrity checking for LUKS or a layer bellow LUKS so it wouldn't propagate errors in case of data corruption, bad memory, possible unsafe shutdowns. In case of unrecoverable data corruption I'd recover it from backup, and I think that is quite small chance that both would get corrupted simultaneously. Any ideas are very welcome :)

284

1 + 6

storage

lvm

btrfs

luks

vidarlo

12/27/23, 2:42 PM

Configuring disk encryption on a single laptop probably doesn't qualify as managing systems in a business environment.

Alojzij Blatnik

12/27/23, 2:44 PM

@vidarlo what do you mean?

vidarlo

12/27/23, 2:44 PM

Your question is offtopic here. It may be on topic on superuser or unix SE.

Alojzij Blatnik

12/27/23, 2:48 PM

Okay, but actually that's for business, although 1 person self-employed business :) Is it possible to transfer it to superuser or unix in case that's more appropriate?

Nikita Kipriyanov

12/27/23, 3:24 PM

Look for `dm-verity` which uses MAC to implement integrity-supporting block devices. On top of that you may place any file system. Note that damaged blocks (purposely or accidentally) will translate into *I/O errors*, which corresponds to "bottom" (decryption error) output of an decryption function of an authenticated cipher.

Alojzij Blatnik

12/27/23, 6:05 PM

Thanks for info. I was testing a bit and it looks like that verity is intented for read-only device, but there is also dm-integrity which blows on a single bad bit (although crc could fix single bit errors). But I found this article (https://gist.github.com/MawKKe/caa2bbf7edcc072129d73b61ae7815fb). So, there's a possible solution with raid1, although I'd prefer solution with single drive and backup for bigger corruption.

Score:1

Server

Alojzij Blatnik

12/28/23, 7:18 PM

I checked quite few options (for encrypted drive). Note that I'm not familiar much with ZFS. Also, btrfs DUP on SSD may not be 100% "duplicated", because wear leveling may place the copy on the same area, so both copies could get damaged.

single drive

LUKS + btrfs with metadata (and data) DUP

reduces available disk size by half

LUKS with dm-integrity + btrfs with metadata (and data) DUP

reduced write performance by half (when enabled journaling), but btrfs gets less corrupted data

ZFS with native encryption (or on top of LUKS)

two drives

2x LUKS + btrfs with raid1

2x dm-integrity + mdadm (raid1) + LUKS + btrfs with metadata (and data) DUP

ZFS' equivalent of raid1 and native encryption (or on top of LUKS)

+ 0

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Setting up resilient single drive NVMe storage for LUKS encryption

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.