I am curious about the following claim from the Cryptsetup FAQ:
2.4 What is the difference between "plain" and LUKS format?
First, unless you happen to understand the cryptographic background well, you should use LUKS. It does protect the user from a lot of common mistakes. Plain dm-crypt is for experts.
After reading through the manual I can see the benefit of LUKS in particular situations. However, I do NOT see the need to "understand the cryptographic background" to use plain dm-crypt.
From reading the manual, I understand that:
- There are some things done in LUKS (like hashing) that don't happen in plain dm-crypt. The result is that I need a bit more entropy in my passphrase to make it safe.
- In plain mode you can argue it's easier to accidentally overwrite encrypted data.
The second point is not really related to understanding cryptography, and it doesn't seem to require expert cryptography knowledge to prevent this (note that I do agree that this is a risk and it can easily happen, even to the best, but I would just argue that having or not having expert cryptography knowledge does not have much of an impact).
So on to the first point. In the same manual the following is stated:
5.12 What about iteration count with plain dm-crypt?
Simple: There is none. There is also no salting. If you use plain dm-crypt, the only way to be secure is to use a high entropy passphrase. If in doubt, use LUKS instead.
This implies to me that the only thing that is needed to have a secure setup with plain dm-crypt, cryptography wise, is to use a high entropy passphrase (higher than what could be used in LUKS for the same lever of security). Again, it doesn't take rocket science to understand or apply this.
Likely, I am not understanding or capturing something important here, but my question is therefore: what is the kind of cryptography knowledge required that makes dm-crypt only recommended to experts? If I stick to standard operations, and I do not require any of the features from LUKS, what risks am I as a non-expert taking?