An encrypted ext4 container will always leak the superblock information.
So encrypting an unencrypted metadata file system like ext4 is inherently vulnerable because it instaleaks?
Shouldn't it then be an absolute requirement to do at least double encryption to prevent this (so that the outer encryption maps to random looking encrypted data, which is the second encrypted container of the actual file system)? Or does the nature of the encryption algorithm (like serpent-xts-plain64 with a 512 bit key) solve this by making decyption entirely unfeasible even knowing the data-->encrypted data vector?
-
Almost also requires an ext4 update to make some very static metadata to be entirely dynamic in terms of location?– user145453Commented Apr 27, 2022 at 18:08
-
Are you asking about how metadata encryption can be implemented? Or if your question is whether or not have pointers to encrypted data is a risk: that doesn't make encryption automatically decryptable, regardless of the algorithm (though maybe I'm misunderstanding? What exactly are you concerned about leaking?). Also, I believe Veracrypt has layered encryption features like what you were proposing.– belkarxCommented Apr 27, 2022 at 18:40
-
Ext4 by default has 1024 bytes of padding at the very beginning of the partition. So it's lots of zeros right on the first couple of blocks. Which means you can get the key right away on any symmetric cipher.– user145453Commented Apr 27, 2022 at 21:12
-
1Isn't that a different problem? How does that relate to the exposure of the superblock?– belkarxCommented Apr 28, 2022 at 0:12
-
AES is resistant in general to known-plaintext attacks (crypto.SE: Why is AES resistant to known-plaintext attacks?). Is there something about zeros specifically that allows a key-recovery attack? Almost certainly not, or that would be a major weakness in block-level encryption of whole partitions, so it would be surprising if there's a problem nobody's noticed until now. (Or it's something that disk-encryption software has to work around somehow with a special case.)– Peter CordesCommented Apr 28, 2022 at 4:38
|
Show 1 more comment
1 Answer
As a practical matter, every encrypted data container is going to have some sort of unencrypted (but possibly authenticated) metadata to help identify it and extract important information, like algorithms and parameters used. There are some steganographic containers that don't have this, but in most cases, we assume the attacker knows that our data is encrypted and with what algorithms, and they cannot decrypt the data more easily than with brute force, and having this metadata makes life simpler.
If you're using ext4 built-in encryption, then you have the problem that the superblock is exposed. However, most people don't use that; they use LUKS to encrypt the entire partition and therefore the entire file system is encrypted. If exposing the superblock information is a problem for you, then LUKS is the way to go. Note, however, that LUKS also has a header which contains metadata about the encrypted contains, but it probably exposes less data than the ext4 superblock.
