Sample Header Ad - 728x90

Is it possible to enable dm-integrity on an existing LUKS/cryptsetup device?

0 votes
1 answer
2298 views
I have a large LUKS2 device created with cryptsetup that holds an LVM2 with my root and other filesystems. The device is several TB in size and I don't have any others disks (or combinations of disks) that it could be intermediately copied to. I recently learned about DM-Integrity and that DM-Crypt has a built-in version of it that can be optionally enabled, and I would like to start using it with my encrypted devices. All of the documentation describes setting it up when the device is created, however, and the cryptsetup reencrypt function doesn't seem to mention it. I would imagine that the integrity info takes up more space than without it, but I have plenty of free space in that regard. I'm willing to settle for DM-Integrity on a separate layer, but would like to avoid it if possible.
Asked by ATLief (328 rep)
Nov 18, 2021, 09:49 PM
Last activity: Nov 19, 2021, 09:16 AM