Questions tagged [luks]
LUKS (Linux Unified Key Setup) is a disk-encryption specification.
151
questions
0
votes
0
answers
10
views
How to encrypt with LUKS a live Ubuntu usb stick that has been customized with Cubic? [migrated]
I'm using Cubic (https://github.com/PJ-Singh-001/Cubic) to create a custom Ubuntu. So far so good, everything is going smoothly.
However, I would like to encrypt the USB stick that contains my custom ...
- 304
1
vote
0
answers
121
views
LUKS: How many iterations are enough?
The luksFormat command accepts iteration time as a parameter, not iterations. That obviously leads to quite different number of iterations depending on the hardware doing the encryption. However if ...
- 405
1
vote
1
answer
72
views
Using TPM to unlock LUKS/dm-crypt volume
I am trying to understand the risks of configuring passwordless decryption via TPM of a LUKS/dm-crypt system with something like:
systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=0+1+2+3+4+5+7+8 /...
- 251
0
votes
1
answer
59
views
Is deploying a web application to a customer's encrypted drive a secure solution against code theft?
I have developed a web service for customer. The web service is written in Python and running in Docker containers. It is managed by docker compose.
The customer wants my web service to run on their ...
0
votes
0
answers
53
views
PCR to prevent TPM2 key unsealing in case of rogue DMA devices connected?
Security threat: physical theft of a laptop and a server that use TPM2 auto unlock FDE with LUKS. In both cases the TPM checks against some PCRs before unsealing the key. The laptop prompts for a TPM ...
- 63
0
votes
0
answers
35
views
Is specifying resume_offset for hybernation to LUKS-encrypted drive safe?
I need to enable hybernation to the LUKS-encrypted drive. My /boot partition is unencrypted hence it stores all kernel images as well as kernel parameters in unencrypted form. For hybernation to work ...
- 23
1
vote
1
answer
418
views
How does a TPM module protect keys LUKS keys on Linux
I'm looking into hardening an embedded device using TPM2 with an encrypted root (/) Linux partition. I've found various articles explaining how to embed LUKS keys into the TPM (eg this one). Unless ...
- 111
0
votes
1
answer
359
views
LUKS brute force risk?
If a person finds an old hard drive that was partially overwritten and let's say 1GB of that wasn't and was formerly used for part of a LUKS encrypted partition, what is the risk that such data, which ...
- 1
0
votes
1
answer
127
views
Remote Laptop disk encryption, break glass
I am stuck with an issue of needing a break glass account on remote laptops.
It's a bit a strange situation. The laptops are built and rebuilt remotely using a small PXE setup that goes with the ...
- 1
0
votes
1
answer
163
views
Does faulTPM defeat the LUKS-based FDE with a passphrase?
The recent faulTPM paper (https://arxiv.org/pdf/2304.14717v1.pdf) deals mostly with Bitlocker and only mentions LUKS to note the differences.
The authors state:
With a passphrase, however, the same ...
- 143
1
vote
2
answers
326
views
Full disk encryption with LUKS?
I encrypted my Ubuntu Desktop 20.04.3 with LVM/LUKS during the installation process. If I turn off the computer, is the brute force the only attack available for getting the password and accessing the ...
- 11
1
vote
3
answers
658
views
Which one is safer for persistent online data? Gpg per file encryption vs gpg encrypted image vs LUKS2 image
3 people need to share some data through cloud. The total amount of data is small (<5gb in total). The update rate is very low, 1 per month. The cloud has very limited security measures so we ...
- 131
1
vote
1
answer
171
views
LibreOffice password vs cryptocontainer (LUKS, VeraCrypt etc.)
How much worse is encrypting a LibreOffice document with the built-in mechanism than using a cryptocontainer (LUKS, VeraCrypt, etc.) and storing the document in it?
I am more comfortable using the ...
- 11
0
votes
1
answer
81
views
Does an SSD store software-encrypted data in unencrypted form somewhere?
I use LUKS encryption on my entire drive. Do SSD drives ship with any storage areas which store unencrypted data, even though the data is saved encrypted on user-available SSD storage?
Maybe inside ...
- 23
0
votes
1
answer
88
views
Does filesystem compression aid cryptanalysis?
I use LUKS to encrypt all sensitive data on my computer. If I switch to using a filesystem with on-the-fly data compression such as ZFS, should I use its compression feature together with LUKS? Does ...
- 23
0
votes
2
answers
631
views
Is it unsecure to use only a passphrase in luks for whole system partition encryption?
When i use only a passphrase in luks for my whole system partition encryption,
so i need to insert a password to decrypt my system partition to boot up my os,
is this unsecure and can it be cracked ...
- 119
1
vote
1
answer
519
views
LUKS: longer passphrase iteration count
From the manual of cryptsetup:
Passphrase processing: Whenever a passphrase is added to a LUKS header
(luksAddKey, luksFormat), the user may specify how much the time the
passphrase processing should ...
- 111
0
votes
1
answer
70
views
Add directory of Luks partition to system PATH
I would like to keep some secret executable binaries inside a LUKS partition.
This partition is not mounted automatically at boot, but only manually in some moments
I would like to automatically add a ...
- 121
0
votes
3
answers
918
views
How difficult is it to decrypt a disk encrypted with luksOpen?
I have encrypted a disk on my Ubuntu machine using
sudo cryptsetup luksOpen /dev/sdb1 sdb1
I'm wondering how difficult is it to decrypt this disk using bruteforce password guessing?
What does the ...
- 383
1
vote
0
answers
153
views
Does secure boot prevent evil maid attacks when using LUKS?
When one installs Debian 11 with secure-boot enabled, is computer protected against evil maid attacks trying to capture encryption keys using software keylogger?
Disk is formatted using defaults which ...
- 219
0
votes
1
answer
882
views
is it possible to change luks2 --key-size from 512b to 256b without losing data?
I created luks2 device with default options which used aes-xts with 512b key size.I figured out that 256b is somewhat faster than 512b from benchmarks. So, I just want to use 256b but not sure if it's ...
- 105
-1
votes
1
answer
559
views
Just found out about luksDump in LUKS (cryptsetup), Is there a way to hide all these sensitive data like used cipher and hash?
I have been using cryptsetup for a while now and just found out about the option 'luksDump'. I am used to similar tools like veracrypt and truecrypt and I am a bit shocked that all these vulnerable ...
- 1
0
votes
1
answer
179
views
Bypass encryption by altering source code
In the Cryptsetup Frequently Asked Questions page it says:
You are asked a passphrase of an existing key-slot first, before you can enter the passphrase for the new key-slot. Otherwise you could ...
- 103
0
votes
3
answers
730
views
How good/bad are these transparent Linux consumer FDE setup options? (e.g. for auto-unlocking LUKS)
UPDATED Summary: I'm looking at Linux FDE options that are transparent to the user (my parents) in that the user doesn't need to enter 2 passwords. I found/thought of several options and tried to ...
- 331
20
votes
3
answers
11k
views
Is LUKS still an effective option for consumer FDE considering Elcomsoft can break it?
I use Fedora Linux and was recently looking into doing Full Disk Encryption on data drives such as /home on some of my / my family's PCs. I understand that LUKS security will be partially dependent on ...
- 331
1
vote
1
answer
1k
views
Linux/LUKS/Full Disk Encryption: How can I mitigate SSD/flash media security security risk caused by unreliable physical deletion?
Firstly, I do not think my question is answered by SSD full disk encryption as I am not looking for a binary "is FDE secure" - nothing is perfectly secure; rather I am looking for possible ...
- 11
1
vote
1
answer
345
views
Security against local attack for remote FDE decryption?
Is there any remote FDE decryption that is resistant to an attacker that has local physical access?
Tools like dracut-sshd need to store the private key used for the sshd server on the unencrypted ...
- 21
0
votes
1
answer
708
views
Do LUKS2 encrypted partitions with Keyfiles use a KDF?
I gather from the cryptsetup manpages that LUKS2 uses argon2i by default for strengthening a user-password to decrypt the partition. However if a 256 bit keyfile with data from /dev/random, how does a ...
- 125
1
vote
1
answer
2k
views
Is it secure to automatically unlock encrypted system drive using the TPM PCR values?
A simple way of automatically decrypting system drive at boot time:
clevis luks bind -d /dev/yourdrive tpm2 '{"pcr_ids":"4,5"}'
systemctl enable clevis-luks-askpass.path
When I ...
2
votes
1
answer
790
views
dm-crypt 2.0.3 + luks: salt auto-generated? what affects decryption speed?
I am trying to encrypt one of my primary Linux partition (5GB) by following this example to encrypt.
I want to confirm some of my understandings:
Salt is automatically generated by cyrptsetup with ...
- 153
0
votes
0
answers
335
views
Better security for storing certificates in LUKS or softhsm?
What is the best place to store certificates and keys which are confidential and sensitive?
As I understand LUKS is fine and kernel transparently handles encryption/decryption. Also, the LUKS volume ...
3
votes
1
answer
388
views
Can I secure the bootloader without a TPM?
I have a lot of PCs without a TPM installed. Buying TPMs for all of them is not an option, but I still want to do encryption on them.
From what I've studied so far, the entire system/boot partition ...
- 133
0
votes
0
answers
1k
views
How to find the encrypted master key in LUKS header
One assignement of my teacher is driving me crazy because I don't think I'm that far from the solution but I still can't get it so I hope someone will be able to help me figure it out.
Assignment
The ...
0
votes
0
answers
1k
views
How secure is LUKS encryption?
I have encrypted a hardsik with a 12 charachter random alphanumeric passwrod using LUKS encryption on Ubuntu 18.04 on a 2.5" SATA disk partitioned with ext4.
I'm wondering how secure is such ...
- 437
1
vote
0
answers
173
views
Entered FDE password in GRUB by mistake
For several reasons (I have an external monitor, etc.) when I booted the laptop I typed the FDE (Full Disk Encryption on Linux, LUKS) without looking at the monitor, and I ended up typing the full ...
- 15.7k
1
vote
0
answers
127
views
Backing-up to an untrusted cloud
Not sure if this kind of review/validation question is allowed - please delete if it isn't.
Like many before, I'm looking for ways to do cloud backup in a way where I trust that I'm still the only one ...
- 111
0
votes
1
answer
534
views
Full disk encryption and remote unlocking a mail server in the hand of a possible attacker, what could go wrong?
Since I cannot receive email directly from my home server, I need an external device to receive messages for me and deliver them to my MTA via another port or via VPN. Instead of renting a VPS just ...
- 63
0
votes
1
answer
283
views
Is there any added benefit to using a random keyfile of more than 512 bits?
Most of the online guides I found about using dm-crypt with a random keyfile use files bigger than 512 bits (64 bytes).
For example:
dd bs=512 count=4 if=/dev/urandom of=keyfile iflags=fullblock
As ...
- 11
3
votes
4
answers
3k
views
How safe is dm-crypt/LUKS? Would TPM make me more secure in this case?
I’ve been looking to purchase a new laptop and I need to have security in mind. I’ve specifically been looking for laptops with discrete or integrated TPM because it’s been my understanding that TPM ...
- 41
2
votes
1
answer
911
views
ZFS on LUKS2 encrypted device: LuksFormat with or without dm-integrity?
Does it make sense to combine ZFS with LUKS2 for completely random-looking encryption on HDDs ? (Without luks-header on the disk of course, header placed elsewhere). The goal is to make a HDD really ...
- 21
3
votes
3
answers
244
views
Drawback of Multi Level Encryption
I am backing up my files to a RAID mirrored HDD, that has full disk encryption (FDE) in place with LUKS. Until now I did this with rsync, but I recently switched to a new backup program that does file ...
- 131
0
votes
1
answer
1k
views
What kind of "actions" can a TPM2 policy authorize?
I've been instructed to use the state of our system's TPM's PCR registers to prevent the system we're working on from booting if one of the PCR registers is different from what we expect. In service ...
- 21
48
votes
4
answers
16k
views
Aren't keyfiles defeating the purpose of encryption?
I just added a drive to my system which is basically a partition mounted for extra storage. I'd like to encrypt it to protect my data in case of god knows what, and by doing that I'd need to enter the ...
- 787
3
votes
1
answer
650
views
LUKS - Too large detached header size when large offset
I find cryptsetup to have an inconsistent way of dealing with headers, I'm tempted to call it a bug
I would like to achieve a very large LUKS offset without resulting in a very bulky detached header
...
- 31
2
votes
1
answer
537
views
Storing LUKS master key in SGX enclave
Is it possible to store the master decryption key for accessing a LUKS encrypted volume inside an SGX enclave so that the master key cannot be accessed by any user on the system, even the root user ...
- 998
1
vote
1
answer
401
views
Why is my LUKS header listed twice?
Why is the metadata in my LUKS header listed twice?
I started poking at the bits in a drive that's encrypted with LUKS, and I found some metadata in a JSON object. What's odd though is that the same ...
- 998
1
vote
1
answer
306
views
What is a LUKS cipher-name "@"?
In analyzing the LUKS header on an encrypted volume, the cipher-name field shows a single-character = '@'. What does that mean?
The LUKS On-Disk Format Specification originally published by Clemens ...
- 998
2
votes
1
answer
3k
views
How to determine start and end bytes of LUKS header?
How can I determine the exact start byte and exact end byte of a LUKS header on a block storage device?
I use Linux Unified Key Setup (LUKS) for Full Disk Encryption (FDE), so all of the data on my ...
- 998
1
vote
1
answer
246
views
Stealing Veracrypt or LUKS hash while system running?
If a hacker gains access to an encrypted system (Veracrypt, LUKS or any other software) via the internet while the system is running - can they steal the hash from RAM and later use that hash to ...
- 411
0
votes
0
answers
499
views
Possible to restore LUKS header from partition that uses the exact same password and keyfile?
I was in Windows 10 and it told me I needed to Initialize Disk so I clicked it and now my LUKS header has been overwritten. I created my encrypted partitions in Linux with cryptsetup command. However, ...
