Questions tagged [dm-crypt]

dm-crypt is a disk encryption system included in the Linux kernel.

Filter by
Sorted by
Tagged with
2
votes
0answers
29 views

Best luks setup disk [duplicate]

I want to encrypt my disk but I want to know what is the best configuration, I currently use ths: cryptsetup -v --cipher serpent-xts-plain64 --key-size 512 --key-file=- --hash whirlpool --iter-time ...
0
votes
1answer
88 views

security of cryptsetup(8) luksRemoveKey, feasibility of extracting MasterSecretKey and using it later

I looked at https://crypto.stackexchange.com/a/24024 and it seems to me cryptsetup(8) luksRemoveKey is weak. The situation: I create new LUKS volume, copy stuff into it. I add a new pass phrase, and ...
0
votes
1answer
172 views

dm-crypt/LUKS: one-time password

I've setup arch using dm-crypt / luks, with a passphrase and a key, lost one of them will fail to login. But I feel I need more secure of passphrase, how to setup dm-crypt / luks that has one-time ...
0
votes
1answer
332 views

Access encrypted files (dm-crypt/LUKS) through web app

I'm a newbie to encryption issues and I'm trying to sort out a few questions. For a distributed application we need to deploy a server outside of our company with sensitives PDF files on it. That ...
0
votes
1answer
155 views

Mapping of encrypted to decrypted blocks in LUKS

Section 2.4 What is the difference between "plain" and LUKS format? of the cryptsetup Frequently Asked Questions says the primary advantage of plain dm-crypt (no LUKS) is: ...high resilience to ...
3
votes
3answers
2k views

EFI: encrypt ESP

I wonder if it possible to encrypt an EFI system partition (ESP)? I would like to set up a virtual machine (VirtualBox) using EFI as boot manager which is supported by the used OS (archlinux). Is ...
2
votes
1answer
96 views

Does posting the technique I used to encrypt my Linux system make the encryption inherently less secure?

I recently encrypted my laptop, but I also wrote notes on how I did it and posted those notes online. The configuration is fairly complicated and, from what I can tell, also fairly unique. I did not ...
4
votes
3answers
6k views

access to mounted luks partition by non-root user

Recently I searched substitute for truecrypt and played a bit with cryptsetup. The steps I did: mkfs -t ext4 /dev/sdb1 sudo cryptsetup open --type luks /dev/sdb1 enc_vol sudo mount /dev/mapper/...
3
votes
3answers
4k views

How can I extract the encrypted master key from LUKS header?

I know that a LUKS partition has a plain-text header that stores many informations like master key (MK) digest, MK iterations of PBKDF2, information about the 8 key-slots etc. I also know that in the ...
19
votes
4answers
11k views

What does LUKS header contain?

What is contained inside the LUKS header? I know, the header has size of 2MB. Also, cryptsetup supports "detached header", where the header can be stored in a separate file. Thus, for example, I can ...
2
votes
1answer
766 views

Laptops SSD: Hardware Encryption plus DM-Crypt/Luks - Security and Performance

I just bought a new Thinkpad t450s, and put a Samsung 850 pro in it. My Cpu supports AES-NI and the SSD supports hard-ware based encryption. My question is, is there any reason to do Both Hardware-...
2
votes
1answer
694 views

How to wipe disks before encryption with dm-crypt if CBC or XTS is used internally?

First, please forgive me if I'm posting this question to the wrong community. Feel free to migrate this post to the right community if I was wrong. I'm quite new to whole disk encryption (but not ...
4
votes
2answers
3k views

Performances of dm-crypt vs. ecryptfs [closed]

The only information I found about the difference of performance between dm-crypt (LUKS mode) and ecryptfs is that given that ecryptfs operates at filesystem-level, it may be slower when doing ...
4
votes
1answer
2k views

Decryption using GRUB and TPM

I'm trying to plan security routine for my new Linux install and few questions came up during searching for solution which meet my needs. Is it possible to use private key from TPM in GRUB to decrypt ...
1
vote
1answer
231 views

Attacks on encrypted computer?

I think we all know the fact that boot-harddrives can be encrypted. Windows usually uses Bitlocker (relying on AES-CBC) and Linux / Unix usually uses dm-crypt (relying on AES-CBC) and the rest of the ...
22
votes
3answers
14k views

Why is plain dm-crypt only recommended for experts?

I am curious about the following claim from the Cryptsetup FAQ: 2.4 What is the difference between "plain" and LUKS format? First, unless you happen to understand the cryptographic background ...
2
votes
2answers
377 views

Server full disk encryption protection from malware

A group of LINUX servers is using dm-crypt to encrypt data. The servers do not store data long-term but are only temporary stopping points for data before it is sent to other systems. The time the ...
0
votes
1answer
704 views

Is it safe to mount luks over cifs?

I have a server with a .img file this is encrypted with luks(aes-256,plain64,xts,sha512) Is it safe to mount this image over cifs(samba), or does doing so risk exposing the volume password or master ...
44
votes
9answers
15k views

Is full disk encryption on a server in a secure data center pointless?

I am having a debate with several people regarding how much protection full disk encryption provides. dm-crypt is being used to encrypt data which is required by my company to be encrypted at rest. ...
0
votes
1answer
567 views

dm-crypt over iSCSI

I recently bought a NAS that supports iSCSI. I'd like to create a new LUN, and then from my computer, create a new dm-crypt/LUKS device on it and back up to it. Is this secure? Could the data or ...
23
votes
1answer
2k views

Linux, TRESOR and XTS

I want to switch from using LUKS for full disk encryption to TRESOR. TRESOR tries to prevent cold boot attacks by storing the encryption key in the CPU's registers. It uses the kernel's crypto API for ...
11
votes
1answer
9k views

XTS vs AES-CBC with ESSIV for file-based filesystem encryption

In a blog post I recently read called "You Don't Want XTS," the author explains some of the pitfalls of using XTS to encrypt filesystems. Specifically, he recommends against ever sharing encrypted ...
2
votes
2answers
2k views

Encrypted offsite storage using sshfs and cryptsetup/dm-crypt/LUKS

I'm interested in an encrypted offsite storage scheme, but I don't want to depend on the vendor for encryption. I have an idea for doing so by combining sshfs with cryptsetup/dm-crypt/LUKS, but I'd ...