LUKS (Linux Unified Key Setup) is a disk-encryption specification.

learn more… | top users | synonyms

54
votes
2answers
38k views

How secure is Ubuntu's default full-disk encryption?

How secure is the encryption offered by ubuntu (using the disk utility)? What algorithm is used underneath it? If someone could at least provide a link to some documentation or article regarding that ...
47
votes
5answers
12k views

Are there any reasonable TrueCrypt forks?

Unfortunately, TrueCrypt may have been discontinued yesterday. I use LUKS on Linux, but I liked the fact that with TrueCrypt I had a portable solution across Windows, Mac, & Linux. TrueCrypt ...
19
votes
2answers
21k views

Recommended options for LUKS (cryptsetup)

I'm looking for recommended options for cryptsetup to create fully encrypted SSD (SanDisk SSD U100 128GB), which achive: Timing O_DIRECT disk reads: 1476 MB in 3.00 seconds = 491.81 MB/sec Timing ...
15
votes
2answers
10k views

For LUKS: The most preferable and safest cipher?

I'm about to encrypt two of my hard drives using LUKS, since I can't really do it myself I use the guide on the Arch Linux wiki (which can be found here). In an example in the guide the cipher ...
10
votes
3answers
487 views

what does LUKS header contain?

What is contained inside the LUKS header ? I know, the header has size of 2MB. Also, cryptsetup supports "detached header", where the header can be stored in a separate file. Thus, for example, I can ...
10
votes
1answer
199 views

Using TPM with well-known SRK/owner passwords?

First, I will explain roughly how I plan to use the TPM: I am using something called tpm-luks which stores a key in both TPM NVRAM and adds the key to one of the LUKS keyslots. The initramfs then ...
8
votes
2answers
1k views

Filling the disk with random data prior to encryption?

Filling the disk with random data prior to encrypting it will supposedly make it harder for the attacker to perform any cryptanalysis. Most sources seem to state this is because it will be harder for ...
7
votes
2answers
182 views

Can BTRFS provide authentication on an encrypted disk?

One of the problems of disk encryption is providing authentication. An attacker with access to the ciphertext can modify the ciphertext at will without consequence. Given, this isn't a likely attack, ...
5
votes
2answers
1k views

Erasing encryption (LUKS) keys before suspend-to-RAM?

I recently had been wondering if there is a way to erase my LUKS keys from RAM before I suspend my device (usually a laptop) to S3 mode. I am interested in a solution that would work for my / ...
4
votes
1answer
131 views

Overwriting disk with random data vs. encrypted zeros

Most disk encryption guides recommend to overwrite the disk with random data before encryption, this is discussed here. However the time this takes with the "standard" source of random data can be ...
4
votes
1answer
1k views

Is using decrypt_derived more secure than a keyfile?

Say I have two partitions on a Linux system, a root partition (/) and a /home partition. Both of them are encrypted with LUKS. The /home partition needs only to be decrypted if / is unlocked and ...
4
votes
1answer
154 views

LUKS TPM disk encryption attacks

Is it possible, or are there any known attacks, to get the encryption key for disk encryption tpm-luks? (Linux LUKS using encryption key stored in TPM) I know that there are attacks like cold boot ...
4
votes
1answer
167 views

Does LUKS protect the filesystem integrity?

I have read in: http://css.csail.mit.edu/6.858/2013/readings/bitlocker.pdf that Bitlocker does not provide data integrity since it takes more space in the disk. The PDF says also that drive ...
4
votes
1answer
672 views

Brute Forcing LUKS Full Disk Encryption - Time?

let's say we have encrypted our drive with AES 256 XTS and the following Hash: SHA1 with ~500k Iterations and a 20+ password SHA512 with ~250k Iterations and the same 20+ password. Let's think of ...
3
votes
2answers
939 views

LUKS nuke efficiency

I am wondering about LUKS nuke patch efficiency. In fact, I think I don't really understand it. From what I know of LUKS, a passphrase is used to encrypt a random key (the master key), which is used ...
3
votes
1answer
35 views

Change LUKS encryption key (not passphrase) without dataloss

You can change the LUKS passphrase without dataloss, but can you also change the actual key? I reckon you would have to re-encrypt the whole disk, but that would be acceptable to me. Background We ...
3
votes
1answer
119 views

Laptops SSD: Hardware Encryption plus DM-Crypt/Luks - Security and Performance

I just bought a new Thinkpad t450s, and put a Samsung 850 pro in it. My Cpu supports AES-NI and the SSD supports hard-ware based encryption. My question is, is there any reason to do Both ...
3
votes
2answers
2k views

TrueCrypt VS LUKS Bruteforce Resilience

I have been researching LUKS vs TrueCrypt topics -- my only concern is security, but most of the discussions I see focus around usability / interoperability . I know TrueCrypt has a bunch of nice ...
3
votes
1answer
49 views

How can AES-CBC be used for LUKS encryption, when the ciphertext is not static?

In CBC mode of operation, ciphertext from previous block is used as IV in next block. How then can AES-CBC be used for disk encryption (LUKS), when the data on the disk (ie the ciphertext) keeps ...
3
votes
2answers
120 views

How can I extract the encrypted master key from LUKS header?

I know that a LUKS partition has a plain-text header that stores many informations like master key (MK) digest, MK iterations of PBKDF2, information about the 8 key-slots etc. I also know that in the ...
3
votes
2answers
939 views

LUKS, how to make strongest possible and reasonable passphrase?

Let us say I have a volume encrypted under LUKS with a 512-bit key. That would mean there are 2 ^ 512 possible values which the key may be. Now I need a passphrase which is at least as resistant to ...
3
votes
2answers
214 views

TrueCrypt LUKS keyfile and password

I understand that a TrueCrypt volume may be encrypted with a password AND a keyfile. As far as I can tell, A LUKS volume may use EITHER a password OR a keyfile, but not both simultaneously for ...
3
votes
0answers
55 views
+100

Right way to use the TPM for full disk encryption

I'm currently setting up a BitLocker equivalent using a TPM and LUKS. I've got the basics right and I'm able to measure the boot process and seal the FDE key using the TPM. Every time the sensitive ...
3
votes
0answers
60 views

LUKS key not available immediately after 'cryptsetup luksFormat'

I'm trying to create a file that will serve as a LUKS filesystem, with cryptsetup 1.6.1 under Ubuntu 14.04 LTS. This is what I'm doing: $ dd if=/dev/zero of=rfs bs=1048576 count=4 $ sudo cryptsetup ...
2
votes
2answers
226 views

Is it possible to boot into root's /bin/bash on a LUKS encrypted device?

I have to check the possibility of case mentioned in the title. An average Linux could be booted up into root's terminal directly without authentication by modifying kernel boot parameters. I'd like ...
2
votes
2answers
122 views

Encrypted container on top of a copy-on-write filesystem

The way I understand it, when you write to a copy-on-write filesystem, data never gets overwritten in place, instead new data is written to a new location, and the old data will only be overwritten ...
2
votes
1answer
705 views

For remotely unlocking LUKS volumes via SSH, how can I verify integrity before sending passphrase?

Although this is closely related to the recently closed question Evil maids in the server room [closed], I believe that it's more answerable. I'd like to unlock LUKS volumes on remotely hosted ...
2
votes
1answer
164 views

access to mounted luks partition by non-root user

Recently I searched substitute for truecrypt and played a bit with cryptsetup. The steps I did: mkfs -t ext4 /dev/sdb1 sudo cryptsetup open --type luks /dev/sdb1 enc_vol sudo mount ...
1
vote
2answers
995 views

best practice for encrypted filesystem inside a file

This is an extension of my question on UNIX. Let's suppose I create a file, map it to /dev/loop0, and create a LUKS partition inside dd if=/dev/zero of=myfile bs=1M count=1000 losetup /dev/loop0 ...
1
vote
1answer
847 views

LUKs Header Backup Security

It seems that one of the weak points in LUKs encryption is that the LUKs header can be a single point of failure if you do not create a backup header for it. My question is: What methods of securing ...
1
vote
2answers
402 views

Initialization of a LUKS encrypted partition with cipher or /dev/urandom

I've created a few encrypted devices with LUKS and cryptsetup on Linux and am pretty comfortable with disk encryption in this regard. I've seen it mentioned in many different places that when setting ...
1
vote
1answer
116 views

Does it makes sense to change the LUKS password in every 90 days?

Linux, NetBSD, etc. can be installed with LUKS, so besides the /boot, all other FS will be encrypted. Probably the kernel needs to be booted before the password prompt gets to the user. The LUKS ...
1
vote
1answer
37 views

Forget LUKS password after mounting or lock LUKS partition when unmounted

When I unmount a LUKS partition using Nautilus, it gets unmounted and locked. Using the command-line, I have to: sudo cryptsetup luksClose encrypted_volume after unmount, otherwise, re-mounting the ...
1
vote
1answer
3k views

Encrypting tails USB boot disk (preeboot password on live)

To use tails, I have always used a DVD, because of the fact I know it will not be tampered with, at least within reason. However there are endless reasons why a USB boot option would be faster, and in ...
1
vote
1answer
365 views

Does changing the keyfile of a LUKS volume after opening it increase key security?

Assuming there is a LUKS volume that uses a keyfile and the keyfile is autogenerated before opening the volume and deleted after use, does changing the keyfile prevent it from being stolen from the ...
1
vote
0answers
149 views

A Solution for Block/File Encryption that is Corruption Resilient? [closed]

Question: What encryption features/(configuration options) are implemented that mitigate issues with device/block corruption? For example, if the external hard-drive gets dropped, the damaged ...
1
vote
0answers
35 views

Would using an interation count greater than 1 with a random keyfile of length greater than the master key be of any benefit?

If I were to have a 4096-bit file of random data (/dev/random) used as a keyfile for LUKS, would there be any benefit to having a key iteration count higher than 1? My reasoning is that the attacker ...
1
vote
3answers
237 views

About SHA1 in default Disk Encryption in Linux

Link to the Thread: Recommended options for LUKS (cryptsetup) I wonder what's the exact difference between SHA1 and SHA512. I know that SHA512 has a longer key but I've read that it doesn't matter ...
0
votes
1answer
138 views

Brute force a hard drive when most of the password is known

I need to access a hard drive that is encrypted with LUKS. The password provided is incorrect, however it is only incorrect by a character or so. The password itself is very strong and above 30 ...
0
votes
3answers
438 views

Mitigating the LUKS decryption key residing in RAM for FDE

I've come to find Full Disk Encryption to be a rather unsafe method of securing data as standardized tools are becoming available to just read out the encryption key from RAM, where the system needs ...
0
votes
1answer
169 views

When using LUKS, which parts of the hard disk are not encrypted?

Due to stories like the following: https://hackerone.com/news/pink-panther (forced at airport customs to decrypt laptop) being more and more frequent, I thought of the following. What if you simply ...
0
votes
1answer
106 views

dm-crypt over iSCSI

I recently bought a NAS that supports iSCSI. I'd like to create a new LUN, and then from my computer, create a new dm-crypt/LUKS device on it and back up to it. Is this secure? Could the data or ...
0
votes
2answers
684 views

Encrypted offsite storage using sshfs and cryptsetup/dm-crypt/LUKS

I'm interested in an encrypted offsite storage scheme, but I don't want to depend on the vendor for encryption. I have an idea for doing so by combining sshfs with cryptsetup/dm-crypt/LUKS, but I'd ...
0
votes
1answer
48 views

Is there any security risk with a LUKS-encrypted hard drive being improperly unmounted?

I have a portable harddrive that is encrypted with LUKS. On a computer I use it on, the computer bugs out sometimes and won't let me unmount it correctly. If the computer is powered off without a ...
0
votes
1answer
360 views

Is there an AES 256 LUKS encryption option in Fedora? [closed]

I have certain information on my drive that I don't want anyone (not even me ;) ) to gain access to. I read recently that Fedora only offers EAS 256 LUKS encryption. This just isn't secure enough ...
0
votes
1answer
142 views

Is it a good idea to hash a string and use it as a passphrase?

Is it a good idea to hash(SHA-512/whirlpool) some simple memorable string and use it for passphrase(for LUKS/TrueCrypt container), instead of using just a string like t4k#La93Fs(5w5) as a passphrase?
0
votes
0answers
19 views

Is cryptsetup luksFormat -y --cipher aes-xts-plain --key-size 512 /dev/sdax a insecure setup for luks [duplicate]

Is cryptsetup luksFormat -y --cipher aes-xts-plain --key-size 512 /dev/sdax insecure. If so why and what setup would be good for keeping corporate information safe?
-1
votes
2answers
73 views

Best way to make a Linux install tamper proof

Good day, I am currently planning an environment where it comes down to the biggest security risk being to boot to another environment and tamper with the install on the disk (Older PCs with physical ...
-1
votes
1answer
86 views

How do I change LUKS backend to OpenSSL?

I know there is a way to do it, but I don't know how to do it: the default backend for LUKS is libgcrypt and I want to test it with the openssl cryptographic library. I was told that there is a ...
-1
votes
2answers
1k views

LUKS HDD Encryption crack [closed]

I need help. I actually encrypted two mouths ago my external HDD with LUKS but know i have lost my password. I am so depressed because, all of my life is on this HDD. Is there any possibility to get ...