Is an LVM cache a security leak when using LUKS on LVM?

Since you are caching the LUKS-container, your cache is also encrypted, yes.

I'm using a different setup, where my pv (the acual one and the one used as cache) is on top of luks.

Unencrypted LVM without cache:

[Disk 1  ]
[PV Data ]
[VG      ]
[LV      ]
[Filesyst]

Unencrypted with LVM cache:

[Disk 1  ] [Disk 2   ]
[PV Data ] [PV Cache ]
[VG                  ]
[LV      ]-----------]
[Filesyst]

Yours:

[Disk 1  ] [Disk 2   ]
[PV Data ] [PV Cache ]
[VG                  ]
[LV      ]-----------]
[LUKS    ]
[Filesyst]

Mine:

[Disk 1  ] [Disk 2   ]
[LUKS    ] [LUKS     ]
[PV Data ] [PV Cache ]
[VG                  ]
[LV      ]-----------]
[Filesyst]

Both variants are encrypting fine, I couldn't find any recommendation for putting LVM on top of LUKS or the other way around, so I used the fedora default which installs LVM on top of LUKS. (If I remember right, Debian has the other variant as default)

defect, encrypted data, unencrypted cache:

[Disk 1  ] [Disk 2   ]
[LUKS    ] ⎡ unenc   ⎤
[PV Data ] ⎣PV Cache ⎦
[VG                  ]
[LV      ]-----------]
[Filesyst]

not really for the bonus-points: you can try running photorec on the cache-device. But this would only proof that the cache is defect if you can find something, not that the cache is encrypted if you don't. It makes it even harder because the LVM-Cache doesn't need to save the data ordered/“defragmentated”.


If I add an SSD as an LVM cache to that volume group, is all data on the cache device encrypted?

Yes, it's encrypted because LVM cache works with blocks directly. It has no idea what the underlying data is.

Bonus points for tools that confirm the cache's content.

Fire up any hex editor (hexedit, dhex, etc) and open your logical volume directly. Encrypted data should look like noise.

Tags:

Lvm

Luks