I am using Debian 9.5, Linux Kernel 4.16, I would like to use the dm-integrity feature with cryptsetup.
cryptsetup luksFormat --type luks2 <device> --cipher aes-gcm-random --integrity aead
Nevertheless, I can not figure out how to get the dm-integrity module in the Debian distro.
Are there any other ways otherwise to get crypt + integrity on a Linux partition?
Note - This won't be a bootable disk.
The dm-integrity authenticated encryption support for block devices is part of the Linux kernel since version 4.12.
If it's enabled in your kernel then it should be automatically loaded, when needed.
You can check if your kernel has this feature enabled by verifying its config, for example on a Fedora system:
$ grep DM_INTEGRITY /boot/config-4.17.12-100.fc27.x86_64
CONFIG_DM_INTEGRITY=m
Here it's compiled as a module.
Then check if the module is actually available, e.g.:
$ find /usr -name 'dm-integrity.ko*'
/usr/lib/modules/4.17.12-100.fc27.x86_64/kernel/drivers/md/dm-integrity.ko.xz
If it's not available you can query which package provides that file, e.g. something like:
$ apt-file search 'dm-integrity.ko*' # on Debian
$ dnf provides '*dm-integrity.ko*' # on Fedora
Note that (as of cryptsetup 2.0) the authenticated encryption support is marked as experimental. Also, the release notes warn about using aes-gcm-random:
DO NOT USE in production! The GCM mode uses only 96-bit nonce, and possible collision means fatal security problem.
It's thus better to use one of the other examples from the release notes:
# cryptsetup luksFormat --type luks2 <device> --cipher aes-xts-plain64 \
--integrity hmac-sha256
# cryptsetup luksFormat --type luks2 <device> --cipher chacha20-random \
--integrity poly1305
Finally, the release notes caution:
There will be better suitable authenticated modes available soon For now we are just preparing framework to enable it (and hopefully improve security of FDE). FDE authenticated encryption is not a replacement for filesystem layer authenticated encryption. The goal is to provide at least something because data integrity protection is often completely ignored in today systems.
