LUKS (Linux Unified Key Setup) is a disk-encryption specification.

learn more… | top users | synonyms

44
votes
5answers
10k views

Are there any reasonable TrueCrypt forks?

Unfortunately, TrueCrypt may have been discontinued yesterday. I use LUKS on Linux, but I liked the fact that with TrueCrypt I had a portable solution across Windows, Mac, & Linux. TrueCrypt ...
40
votes
2answers
24k views

How secure is Ubuntu's default full-disk encryption?

How secure is the encryption offered by ubuntu (using the disk utility)? What algorithm is used underneath it? If someone could at least provide a link to some documentation or article regarding that ...
12
votes
2answers
13k views

Recommended options for LUKS (cryptsetup)

I'm looking for recommended options for cryptsetup to create fully encrypted SSD (SanDisk SSD U100 128GB), which achive: Timing O_DIRECT disk reads: 1476 MB in 3.00 seconds = 491.81 MB/sec Timing ...
11
votes
2answers
6k views

For LUKS: The most preferable and safest cipher?

I'm about to encrypt two of my hard drives using LUKS, since I can't really do it myself I use the guide on the Arch Linux wiki (which can be found here). In an example in the guide the cipher ...
7
votes
2answers
810 views

Filling the disk with random data prior to encryption?

Filling the disk with random data prior to encrypting it will supposedly make it harder for the attacker to perform any cryptanalysis. Most sources seem to state this is because it will be harder for ...
5
votes
1answer
217 views

Brute Forcing LUKS Full Disk Encryption - Time?

let's say we have encrypted our drive with AES 256 XTS and the following Hash: SHA1 with ~500k Iterations and a 20+ password SHA512 with ~250k Iterations and the same 20+ password. Let's think of ...
4
votes
2answers
530 views

Erasing encryption (LUKS) keys before suspend-to-RAM?

I recently had been wondering if there is a way to erase my LUKS keys from RAM before I suspend my device (usually a laptop) to S3 mode. I am interested in a solution that would work for my / ...
3
votes
2answers
227 views

LUKS nuke efficiency

I am wondering about LUKS nuke patch efficiency. In fact, I think I don't really understand it. From what I know of LUKS, a passphrase is used to encrypt a random key (the master key), which is used ...
3
votes
1answer
756 views

Is using decrypt_derived more secure than a keyfile?

Say I have two partitions on a Linux system, a root partition (/) and a /home partition. Both of them are encrypted with LUKS. The /home partition needs only to be decrypted if / is unlocked and ...
3
votes
2answers
156 views

LUKS, how to make strongest possible and reasonable passphrase?

Let us say I have a volume encrypted under LUKS with a 512-bit key. That would mean there are 2 ^ 512 possible values which the key may be. Now I need a passphrase which is at least as resistant to ...
2
votes
2answers
209 views

Is it possible to boot into root's /bin/bash on a LUKS encrypted device?

I have to check the possibility of case mentioned in the title. An average Linux could be booted up into root's terminal directly without authentication by modifying kernel boot parameters. I'd like ...
2
votes
2answers
102 views

Encrypted container on top of a copy-on-write filesystem

The way I understand it, when you write to a copy-on-write filesystem, data never gets overwritten in place, instead new data is written to a new location, and the old data will only be overwritten ...
2
votes
1answer
637 views

TrueCrypt VS LUKS Bruteforce Resilience

I have been researching LUKS vs TrueCrypt topics -- my only concern is security, but most of the discussions I see focus around usability / interoperability . I know TrueCrypt has a bunch of nice ...
2
votes
1answer
431 views

For remotely unlocking LUKS volumes via SSH, how can I verify integrity before sending passphrase?

Although this is closely related to the recently closed question Evil maids in the server room [closed], I believe that it's more answerable. I'd like to unlock LUKS volumes on remotely hosted ...
2
votes
0answers
108 views

TrueCrypt LUKS keyfile and password

I understand that a TrueCrypt volume may be encrypted with a password AND a keyfile. As far as I can tell, A LUKS volume may use EITHER a password OR a keyfile, but not both simultaneously for ...
1
vote
2answers
591 views

best practice for encrypted filesystem inside a file

This is an extension of my question on UNIX. Let's suppose I create a file, map it to /dev/loop0, and create a LUKS partition inside dd if=/dev/zero of=myfile bs=1M count=1000 losetup /dev/loop0 ...
1
vote
3answers
128 views

Mitigating the LUKS decryption key residing in RAM for FDE

I've come to find Full Disk Encryption to be a rather unsafe method of securing data as standardized tools are becoming available to just read out the encryption key from RAM, where the system needs ...
1
vote
2answers
111 views

About SHA1 in default Disk Encryption in Linux

Link to the Thread: Recommended options for LUKS (cryptsetup) I wonder what's the exact difference between SHA1 and SHA512. I know that SHA512 has a longer key but I've read that it doesn't matter ...
1
vote
1answer
890 views

Encrypting tails USB boot disk (preeboot password on live)

To use tails, I have always used a DVD, because of the fact I know it will not be tampered with, at least within reason. However there are endless reasons why a USB boot option would be faster, and in ...
1
vote
1answer
331 views

LUKs Header Backup Security

It seems that one of the weak points in LUKs encryption is that the LUKs header can be a single point of failure if you do not create a backup header for it. My question is: What methods of securing ...
1
vote
0answers
30 views

Would using an interation count greater than 1 with a random keyfile of length greater than the master key be of any benefit?

If I were to have a 4096-bit file of random data (/dev/random) used as a keyfile for LUKS, would there be any benefit to having a key iteration count higher than 1? My reasoning is that the attacker ...
0
votes
2answers
103 views

Initialization of a LUKS encrypted partition with cipher or /dev/urandom

I've created a few encrypted devices with LUKS and cryptsetup on Linux and am pretty comfortable with disk encryption in this regard. I've seen it mentioned in many different places that when setting ...
0
votes
1answer
26 views

dm-crypt over iSCSI

I recently bought a NAS that supports iSCSI. I'd like to create a new LUN, and then from my computer, create a new dm-crypt/LUKS device on it and back up to it. Is this secure? Could the data or ...
0
votes
2answers
402 views

Encrypted offsite storage using sshfs and cryptsetup/dm-crypt/LUKS

I'm interested in an encrypted offsite storage scheme, but I don't want to depend on the vendor for encryption. I have an idea for doing so by combining sshfs with cryptsetup/dm-crypt/LUKS, but I'd ...
0
votes
1answer
56 views

When using LUKS, which parts of the hard disk are not encrypted?

Due to stories like the following: https://hackerone.com/news/pink-panther (forced at airport customs to decrypt laptop) being more and more frequent, I thought of the following. What if you simply ...
0
votes
1answer
158 views

Is there an AES 256 LUKS encryption option in Fedora? [closed]

I have certain information on my drive that I don't want anyone (not even me ;) ) to gain access to. I read recently that Fedora only offers EAS 256 LUKS encryption. This just isn't secure enough ...
0
votes
1answer
89 views

Does it makes sense to change the LUKS password in every 90 days?

Linux, NetBSD, etc. can be installed with LUKS, so besides the /boot, all other FS will be encrypted. Probably the kernel needs to be booted before the password prompt gets to the user. The LUKS ...
0
votes
1answer
133 views

Is it a good idea to hash a string and use it as a passphrase?

Is it a good idea to hash(SHA-512/whirlpool) some simple memorable string and use it for passphrase(for LUKS/TrueCrypt container), instead of using just a string like t4k#La93Fs(5w5) as a passphrase?
0
votes
0answers
19 views

Does LUKS protect the filesystem integrity?

I have read in: http://css.csail.mit.edu/6.858/2013/readings/bitlocker.pdf that Bitlocker does not provide data integrity since it takes more space in the disk. The PDF says also that drive ...
0
votes
1answer
237 views

Does changing the keyfile of a LUKS volume after opening it increase key security?

Assuming there is a LUKS volume that uses a keyfile and the keyfile is autogenerated before opening the volume and deleted after use, does changing the keyfile prevent it from being stolen from the ...