I want to make sure that the result of
PBKDF2-HMAC-SHA1 is indissociable from random data (given random parameters). Basically,
PBKDF2-HMAC-SHA1 looks like just a bigger
SHA-1 hash, which is normal given that the pseudorandom function used is
SHA-1 as the name implies.
./pkcs5 -i 1 -s RANDOM_SALT -p RANDOM_PAYLOAD -l 20 c8ddde91936a728445e238badde1ef7e94de5b36
Tool used: dzmitryk / pkcs5.c
Note that it's printed in HEXADECIMAL format so the output really looks like random binary data. Is there any scientific proof that SHA-1 can hardly be differentiated from random data?
& same question for SHA-256.
Why am I asking that?
Because Plain dm-crypt has several disadvantages compared to LUKS:
- Password is not changeable without re-encrypting the whole disk
- Only one password can be used
- The disk encryption key is derived from the password without any salt
- A plain dm-crypt partition may coincidentally end up looking like a unencrypted filesystem, and has a chance of being written to accidentally.
But LUKS has one major flaw: it's not deniable. So by trying to reach this deniable goal, people either use USB keys with unencrypted keyfiles (horrible) or detached LUKS header (not deniable if the opponent finds the USB key...). There is something wrong in those approaches.
So I'm trying to keep the best of LUKS header and make an "Ain't NO LUKS" header that would be indissociable from random data (so DENIABLE), containing only:
- The LUKS keyslots encrypted key payloads - result of AES so random
- The LUKS salts - pure random
- The LUKS masterkey digest - result of on PBKDF2-HMAC-SHA1
Everything else (cipher mode, key length, etc.) would use defaults to be hard-coded in GRUB
cryptomount command or easily parametrizable from the command-line.
EDIT: Related questions on StackExchange cryptography: