4

I have been researching LUKS vs TrueCrypt topics -- my only concern is security, but most of the discussions I see focus around usability / interoperability .

I know TrueCrypt has a bunch of nice passphrase features -- slow hashing algorithm, thousands of iterations, options for multiple keyfiles etc. These features make me feel that secret key security of the encrypted data is quite strong. But I do not know what LUKS does in this respect. I know in TrueCrypt if I make my passhphrase "abc" the final encryption key will not be "abc" it will be the result of some slow hash -- but if I use LUKS what will my key look like if the passphrase is "abc".

(This is a hypothetical example, I don't intend to use a three character passphrase ... I just need to demonstrate my point -- please no discussion of weak passphrases here, I know all about that, assume I will use the maximum amount of characters for any passphrase, LUKS or TrueCrypt.)

Also, I know TrueCrypt offers other features, such as multi-layered encryption with different algorithms and different keys. That sounds like a really good measure, does LUKS have any option like this? When I install the OS (MINT) I only have a checkbox option yes or no to encrypt. I don't see any further configuration options when installing. What are the defaults?

My primary concern here is that while I know a bit about TrueCrypt, and how it works with regards to my security desires, I have no idea how LUKS behaves. Let's say LUKS out of the box does not offer multi-layer encryption or slow hashing, is there a way to enable this post-install? What does it entail to change the LUKS configurations from an existing weaker installation to a stronger one more suited towards the features of TrueCrypt that appeal to me?

To re-iterate, I don't want a discussion of usability. Yes, I have heard the discussion of "poor usability is poor security", but in this case, even if my data isn't so sensitive it needs to be hidden from extra-terrestrial hackers with state financing. Consider this a practice environment to teach myself the strictest and most secure setup. If I suffer a usability related security weakness (human error) then I am to learn from such a mistake.

Thanks for the input, it's always very appreciated.

  • An article in IT World for September 29, 2015 (itworld.com/article/2987438/data-protection/…) reveals the existence of, but doesn't describe fully, two serious flaws in the Windows driver that TrueCrypt installs. It isn't clear from the article whether those flaws compromise the crypto or the underlying Windows OS, or both. It also isn't clear whether that driver is installed only for full-disk encryption or at any time a TrueCrypt volume is in use. – Bob Brown Oct 4 '15 at 18:18
6

The answers you're looking for can be found in the Cryptsetup documentation, but to summarize:

  1. LUKS uses PBKDF2 to derive a "slot key" from your password, with a default iteration count sufficient to take one second on the computer that created the LUKS volume.
  2. This "slot key" is unrelated to the key used to encrypt your data. It is only used to decrypt a copy of the volume master key, which is then used to encrypt/decrypt the data.
  3. You can have up to eight different passwords for unlocking the volume.
  4. Each slot key can have its own derivation function. If you find that one second of PBKDF2 doesn't fit your needs, you can add a new password with different parameters and erase the old one.
  5. There is no support for changing the encryption on a LUKS volume after it has been created.
  6. When creating a LUKS volume from the command line, you can specify the cipher used. The default is "aes-xts-plain64" (AES-128 encryption in XTS mode with no hash function). LUKS does not support layered encryption algorithms.
  7. LUKS does not support hidden volumes the way Truecrypt does, but given that everyone and their dog knows about Truecrypt's hidden-volume support, these "hidden" volumes can't be considered at all secret in the real-world (as opposed to the information-theoretic) sense.
  • 1
    I know this answer is two years old, but I just want to answer to 7. : I think the main advantage of hidden volumes is that even if one knows they exist, nobody can prove that there is in fact a hidden volume in a regular volume without knowing the passphrase. It's therefore a very effective feature. – Elzo Mar 29 '16 at 19:12
  • 2
    It's only an effective feature if cryptanalysis is limited to mathematical techniques. If the investigation can use a $5 wrench, hidden-volume functionality shifts the burden of proof: it's now up to you to prove that the hidden volume doesn't exist. – Mark Mar 29 '16 at 19:23
  • But you can't prove it, so if you are in the hands of such irrational people, you will be beaten anyway. – Elzo Mar 29 '16 at 20:09
  • @YdobEmos Real security is more related to be smart than to be strong. Create the hidden device, let them the key. Save the real hidden data into a sdcard and that's all. If i erease the whole disk in your face, your eyes will told me if there's any hidden volume. If i cut you a finger, your mouth will told me if there's any hidden volume. Your BEST chance is to create one and put dummy shit on it. Then use a 2nd drive like a sdcard to put data then remove and hide it when you don't really use it. Destroying a sdcard is easiest than destroy a sata disk content. Do not trust SSD controllers. – erm3nda Jan 24 '17 at 13:47
  • @YdobEmos in fact, using veracrypt and hidden volumes daily is your best chance to add noise. If you have 20 devices in your logs, better than just 1. You only need to save the real device, then you're ok. If you delete all logs, you'll be flagged as even more suspicious. Be smart and save your fingers :-) – erm3nda Jan 24 '17 at 13:49
1

The disk encrypted by TrueCrypt looks like random data. It has no header, everything is encrypted. Nobody can even prove it contains any data.

LUKS has a header and it could be proven easily that the disk contains LUKS encrypted data. If the police confiscated your laptop on UK borders and they saw it contains LUKS partition they could hold you in the jail until you reveal the password. If you had the partition encrypted by TrueCrypt you can claim it was just securely deleted - at least the negotiation would be easier.

TrueCrypt is death project. It is a big piece of code hard to verify. However, there is a replacement:

https://wiki.archlinux.org/index.php/Tcplay

tcplay has very short code. It can mount and create TrueCrypt images. I made an audit by myself and I can claim it is secure :-).

  • VeraCrypt is the live TrueCrypt alternative – Mohammed Noureldin Dec 9 '16 at 13:54
  • yes, but it inherited old TrueCrypt code and so it has the same problem. Large code which is difficult to verify. – smrt28 Dec 9 '16 at 16:36
  • What problem you mean? – Mohammed Noureldin Dec 9 '16 at 16:49
  • the problem is the large piece of code which is difficult to verify – smrt28 Dec 11 '16 at 11:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.