Block-device encryption without reinstallation [LWN.net]

Block-device encryption without reinstallation

Posted Sep 30, 2025 21:30 UTC (Tue) by muase (subscriber, #178466)
In reply to: Block-device encryption without reinstallation by geert
Parent article: Managing encrypted filesystems with dirlock

Something like that would definitely be possible; BitLocker (Windows) and FileVault (macOS) have been offering similar functionality for years now; speaking from a technical pov, it's a solved problem.

Going further down that road: As LUKS2 supports detached headers, you could even do interesting shenanigans like simply storing luks-<partuuid>.bin in the boot or EFI partitions itself, and simply add another JSON key dmcrypt-progress to the header file. As AES-XTS is zero-size overhead, now you wouldn't even need to touch and shrink the existing partitions/filesystems anymore and could transparently encrypt block by block.

to post comments

Block-device encryption without reinstallation

Posted Sep 30, 2025 22:34 UTC (Tue) by berto (subscriber, #58604) [Link] (2 responses)

Indeed, with detached headers it should be possible.

I'm not familiar with the internals of the device mapper but I can imagine that this would need changes in dm-crypt: you would need to have a device that is only encrypted up to a certain offset, and that offset would change in real time while the device is being used.

Block-device encryption without reinstallation

Posted Oct 1, 2025 15:20 UTC (Wed) by muase (subscriber, #178466) [Link] (1 responses)

I'm not familiar with the internals of the device mapper but I can imagine that this would need changes in dm-crypt: you would need to have a device that is only encrypted up to a certain offset, and that offset would change in real time while the device is being used.

As far as I know, there is cryptsetup-reencrypt, which already has an online-mode for reencryption but it seems that this also supports initial encryption. I'm not sure if you can use it to online-encrypt the currently booted volume; but if I understand the manpage correctly, it should be possible to boot into a minimal environment, start the encryption, convert everything to device-mapper volumes, and then reboot and continue the encryption online.

Block-device encryption without reinstallation

Posted Oct 1, 2025 20:43 UTC (Wed) by berto (subscriber, #58604) [Link]

You're right, and they don't actually had to change the device mapper, they do everything in userspace remapping the device on the fly.