Support for cryptsetup --hw-opal options
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 974
- Forks
- 296
- Avg merge
- 6d 14h
- Merged PRs (30d)
- 9
Description
Feature Request
When creating a LUKS volume the options --hw-opal or --hw-opal-only can be used to enable hardware encryption on drives that support it. In the case of --hw-opal-only it offloads encryption to the hardware entirely, reducing CPU usage.
Environment
Bare metal, SSDs supporting OPAL
Other Information
I had tried to do this by including --hw-opal-only in the options field of a LUKS volume configuration, but it fails because cryptsetup expects, in addition to the encryption key, an OPAL admin password on stdin.
Desired Feature
Also generate the OPAL admin password, perhaps use the same key for both in case of --hw-opal-only?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing how LUKS volume options are passed to cryptsetup and how encryption keys are supplied on stdin. Check cryptsetup's --hw-opal and --hw-opal-only input requirements; done means supported configurations generate and pass the OPAL admin password without weakening key handling, with tests covering both options.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- operating-systems, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100