Questions tagged [dm-crypt]
dm-crypt is a disk encryption system included in the Linux kernel.
31
questions
1
vote
3
answers
208
views
Are there ways to detect plain dm-crypt encryption and what are the countermeasures against them?
Encryption with plain dm-crypt is often positioned as encryption that cannot be recognized. But is it really so? Are there ways to prove that the data is encrypted with plain dm-crypt? How to bypass ...
- 11
0
votes
2
answers
547
views
Is it unsecure to use only a passphrase in luks for whole system partition encryption?
When i use only a passphrase in luks for my whole system partition encryption,
so i need to insert a password to decrypt my system partition to boot up my os,
is this unsecure and can it be cracked ...
- 119
0
votes
1
answer
766
views
is it possible to change luks2 --key-size from 512b to 256b without losing data?
I created luks2 device with default options which used aes-xts with 512b key size.I figured out that 256b is somewhat faster than 512b from benchmarks. So, I just want to use 256b but not sure if it's ...
- 105
2
votes
0
answers
283
views
Reading is much faster than writing with AEGIS-128
I want to use cryptographic integrity checking in Linux. Naturally, I measured performance of different implementations on my computer in order to choose the best. The block device is in tmpfs, in ...
- 158
2
votes
1
answer
733
views
dm-crypt 2.0.3 + luks: salt auto-generated? what affects decryption speed?
I am trying to encrypt one of my primary Linux partition (5GB) by following this example to encrypt.
I want to confirm some of my understandings:
Salt is automatically generated by cyrptsetup with ...
- 153
0
votes
1
answer
259
views
Is there any added benefit to using a random keyfile of more than 512 bits?
Most of the online guides I found about using dm-crypt with a random keyfile use files bigger than 512 bits (64 bytes).
For example:
dd bs=512 count=4 if=/dev/urandom of=keyfile iflags=fullblock
As ...
- 11
3
votes
4
answers
3k
views
How safe is dm-crypt/LUKS? Would TPM make me more secure in this case?
I’ve been looking to purchase a new laptop and I need to have security in mind. I’ve specifically been looking for laptops with discrete or integrated TPM because it’s been my understanding that TPM ...
- 41
0
votes
1
answer
541
views
AES-256 ESSIV in dm-crypt
I am playing around with disk encryption. https://gitlab.com/cryptsetup/cryptsetup/-/wikis/DMCrypt#iv-generators says:
essiv: "encrypted sector|salt initial vector", the sector number is encrypted ...
- 3
2
votes
0
answers
99
views
Best luks setup disk [duplicate]
I want to encrypt my disk but I want to know what is the best configuration, I currently use ths:
cryptsetup -v --cipher serpent-xts-plain64 --key-size 512 --key-file=- --hash whirlpool --iter-time ...
0
votes
1
answer
312
views
security of cryptsetup(8) luksRemoveKey, feasibility of extracting MasterSecretKey and using it later
I looked at https://crypto.stackexchange.com/a/24024 and it seems to me cryptsetup(8) luksRemoveKey is weak.
The situation:
I create new LUKS volume, copy stuff into it.
I add a new pass phrase, and ...
- 8,364
3
votes
2
answers
1k
views
dm-crypt/LUKS: one-time password
I've setup arch using dm-crypt / luks, with a passphrase and a key, lost one of them will fail to login.
But I feel I need more secure of passphrase, how to setup dm-crypt / luks that has one-time ...
- 181
0
votes
1
answer
536
views
Access encrypted files (dm-crypt/LUKS) through web app
I'm a newbie to encryption issues and I'm trying to sort out a few questions.
For a distributed application we need to deploy a server outside of our company with sensitives PDF files on it. That ...
- 103
0
votes
1
answer
250
views
Mapping of encrypted to decrypted blocks in LUKS
Section 2.4 What is the difference between "plain" and LUKS format? of the cryptsetup Frequently Asked Questions says the primary advantage of plain dm-crypt (no LUKS) is:
...high resilience to ...
- 2,795
3
votes
3
answers
5k
views
EFI: encrypt ESP
I wonder if it possible to encrypt an EFI system partition (ESP)?
I would like to set up a virtual machine (VirtualBox) using EFI as boot manager which is supported by the used OS (archlinux). Is ...
- 133
2
votes
1
answer
148
views
Does posting the technique I used to encrypt my Linux system make the encryption inherently less secure?
I recently encrypted my laptop, but I also wrote notes on how I did it and posted those notes online. The configuration is fairly complicated and, from what I can tell, also fairly unique. I did not ...
- 257
10
votes
3
answers
13k
views
access to mounted luks partition by non-root user
Recently I searched substitute for truecrypt and played a bit with cryptsetup. The steps I did:
mkfs -t ext4 /dev/sdb1
sudo cryptsetup open --type luks /dev/sdb1 enc_vol
sudo mount /dev/mapper/...
- 101
4
votes
3
answers
11k
views
How can I extract the encrypted master key from LUKS header?
I know that a LUKS partition has a plain-text header that stores many informations like master key (MK) digest, MK iterations of PBKDF2, information about the 8 key-slots etc. I also know that in the ...
- 401
30
votes
5
answers
30k
views
What does LUKS header contain?
What is contained inside the LUKS header? I know, the header has size of 2MB. Also, cryptsetup supports "detached header", where the header can be stored in a separate file.
Thus, for example, I can ...
- 2,129
2
votes
1
answer
1k
views
Laptops SSD: Hardware Encryption plus DM-Crypt/Luks - Security and Performance
I just bought a new Thinkpad t450s, and put a Samsung 850 pro in it. My Cpu supports AES-NI and the SSD supports hard-ware based encryption.
My question is, is there any reason to do Both Hardware-...
- 123
2
votes
1
answer
1k
views
How to wipe disks before encryption with dm-crypt if CBC or XTS is used internally?
First, please forgive me if I'm posting this question to the wrong community. Feel free to migrate this post to the right community if I was wrong.
I'm quite new to whole disk encryption (but not ...
- 123
4
votes
2
answers
4k
views
Performances of dm-crypt vs. ecryptfs [closed]
The only information I found about the difference of performance between dm-crypt (LUKS mode) and ecryptfs is that given that ecryptfs operates at filesystem-level, it may be slower when doing ...
- 1,935
5
votes
1
answer
3k
views
Decryption using GRUB and TPM
I'm trying to plan security routine for my new Linux install and few questions came up during searching for solution which meet my needs.
Is it possible to use private key from TPM in GRUB to decrypt ...
- 53
1
vote
1
answer
351
views
Attacks on encrypted computer?
I think we all know the fact that boot-harddrives can be encrypted.
Windows usually uses Bitlocker (relying on AES-CBC) and Linux / Unix usually uses dm-crypt (relying on AES-CBC) and the rest of the ...
- 9,670
31
votes
3
answers
21k
views
Why is plain dm-crypt only recommended for experts?
I am curious about the following claim from the Cryptsetup FAQ:
2.4 What is the difference between "plain" and LUKS format?
First, unless you happen to understand the cryptographic background
...
- 1,225
2
votes
2
answers
755
views
Server full disk encryption protection from malware
A group of LINUX servers is using dm-crypt to encrypt data. The servers do not store data long-term but are only temporary stopping points for data before it is sent to other systems. The time the ...
- 639
0
votes
1
answer
1k
views
Is it safe to mount luks over cifs?
I have a server with a .img file this is encrypted with luks(aes-256,plain64,xts,sha512) Is it safe to mount this image over cifs(samba), or does doing so risk exposing the volume password or master ...
- 807
47
votes
10
answers
22k
views
Is full disk encryption on a server in a secure data center pointless?
I am having a debate with several people regarding how much protection full disk encryption provides. dm-crypt is being used to encrypt data which is required by my company to be encrypted at rest. ...
- 639
0
votes
1
answer
905
views
dm-crypt over iSCSI
I recently bought a NAS that supports iSCSI. I'd like to create a new LUN, and then from my computer, create a new dm-crypt/LUKS device on it and back up to it.
Is this secure? Could the data or ...
- 1
22
votes
1
answer
2k
views
Linux, TRESOR and XTS
I want to switch from using LUKS for full disk encryption to TRESOR. TRESOR tries to prevent cold boot attacks by storing the encryption key in the CPU's registers. It uses the kernel's crypto API for ...
- 321
13
votes
1
answer
13k
views
XTS vs AES-CBC with ESSIV for file-based filesystem encryption
In a blog post I recently read called "You Don't Want XTS," the author explains some of the pitfalls of using XTS to encrypt filesystems. Specifically, he recommends against ever sharing encrypted ...
- 6,743
3
votes
2
answers
2k
views
Encrypted offsite storage using sshfs and cryptsetup/dm-crypt/LUKS
I'm interested in an encrypted offsite storage scheme, but I don't want to depend on the vendor for encryption. I have an idea for doing so by combining sshfs with cryptsetup/dm-crypt/LUKS, but I'd ...
- 233