<html><body><div style="color:#000; background-color:#fff; font-family:times new roman, new york, times, serif;font-size:12pt"><div>I do not think decryption and re-encryption will be necessary. I will do my<br>best to describe why via email.<br><br>The image file is used to setup a loop device, which looks like a normal block<br>device. The loop device size is limited to the size of the file backing the<br>loop device. It maps its idea of sectors to locations in the file backing the<br>device. Hence sector 0 will be bytes (0, 511) in the file backing the device.<br>Where those bytes are on the physical disk are unknown.<br><br>Normal block device functions are used to read and write data from a loop <br>device. Hence in Linux this will be a request call. This will tell the block<br>device where to write the data. For example a call could be made to write data <br>to the first sector. The first sector is relative to the loop device and not<br>the
physical device. Therefore data written to the first sector of the loop <br>device will be to the first 512 bytes of the file backing the loop device.<br><br>Now when dm-crypt is used I believe it is setup as another block device that <br>sits above the block device to be encrypted. It will simply encrypt the data <br>before it is sends the request call down to the lower level driver. Consider<br>the example write above again. Now the dm-crypt block device will receive a<br>request to write to the first sector. It will encrypt the data using the sector<br>number as the IV, and then call the lower block device using the same <br>parameters (i.e. send this data to the first sector). The bytes will then be<br>written to the first sector of the loop device, which is the first 512 bytes of<br>the file backing the device, and who knows where on the physical device.<br><br>Since the physical sector is not used in the encryption then I do not see
why<br>the disk would need to be decrypted and then re-encrypted. You could test this <br>by creating a file backed loop device, putting dm-crypt on top, writing data to<br>it, unmounting it all, copying the file, putting dm-crypt on top, and reading<br>the data from it.<br><br>I must point out that I am no Linux kernel guru. I only have a very limited<br>experience. Let me know if this makes sense or not. <br><br>-Nate<br><br>> Greetings Nate, Caitlin!<br>> <br>> With volume snapshots, if a second physical copy is to be made, and an<br>> algorithm such as<br>> AES-XTS is used, how can one escape "decryption followed by re-encryption" give <br>> than AES-XTS<br>> uses the sector address to generate the tweaks for encrypting each sector.<br>> <br>> Regards<br>> Malini</div></div></body></html>