Skip to main content
OverflowAI is here! AI power for your Stack Overflow for Teams knowledge community. Learn more

Questions tagged [luks]

LUKS (Linux Unified Key Setup) is a disk-encryption specification.

Filter by
Sorted by
Tagged with
0 votes
1 answer
84 views

luks increase delays between password attempts

From what I understand, argon provides a delay between password attempts. Does luks allow increasing or reducing the delay?
CarriMegrabyan's user avatar
2 votes
2 answers
516 views

LUKS: How many iterations are enough?

The luksFormat command accepts iteration time as a parameter, not iterations. That obviously leads to quite different number of iterations depending on the hardware doing the encryption. However if ...
graywolf's user avatar
  • 425
1 vote
1 answer
215 views

Using TPM to unlock LUKS/dm-crypt volume

I am trying to understand the risks of configuring passwordless decryption via TPM of a LUKS/dm-crypt system with something like: systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=0+1+2+3+4+5+7+8 /...
StrongBad's user avatar
  • 261
0 votes
1 answer
98 views

Is deploying a web application to a customer's encrypted drive a secure solution against code theft?

I have developed a web service for customer. The web service is written in Python and running in Docker containers. It is managed by docker compose. The customer wants my web service to run on their ...
harry_tums's user avatar
0 votes
0 answers
123 views

PCR to prevent TPM2 key unsealing in case of rogue DMA devices connected?

Security threat: physical theft of a laptop and a server that use TPM2 auto unlock FDE with LUKS. In both cases the TPM checks against some PCRs before unsealing the key. The laptop prompts for a TPM ...
Polizi8's user avatar
  • 163
0 votes
0 answers
81 views

Is specifying resume_offset for hybernation to LUKS-encrypted drive safe?

I need to enable hybernation to the LUKS-encrypted drive. My /boot partition is unencrypted hence it stores all kernel images as well as kernel parameters in unencrypted form. For hybernation to work ...
CurtisB's user avatar
  • 33
1 vote
1 answer
854 views

How does a TPM module protect keys LUKS keys on Linux

I'm looking into hardening an embedded device using TPM2 with an encrypted root (/) Linux partition. I've found various articles explaining how to embed LUKS keys into the TPM (eg this one). Unless ...
Philip Couling's user avatar
0 votes
1 answer
747 views

LUKS brute force risk?

If a person finds an old hard drive that was partially overwritten and let's say 1GB of that wasn't and was formerly used for part of a LUKS encrypted partition, what is the risk that such data, which ...
ppppppp2's user avatar
0 votes
1 answer
186 views

Remote Laptop disk encryption, break glass

I am stuck with an issue of needing a break glass account on remote laptops. It's a bit a strange situation. The laptops are built and rebuilt remotely using a small PXE setup that goes with the ...
scrapps's user avatar
0 votes
1 answer
219 views

Does faulTPM defeat the LUKS-based FDE with a passphrase?

The recent faulTPM paper (https://arxiv.org/pdf/2304.14717v1.pdf) deals mostly with Bitlocker and only mentions LUKS to note the differences. The authors state: With a passphrase, however, the same ...
Leprechaun's user avatar
1 vote
2 answers
465 views

Full disk encryption with LUKS?

I encrypted my Ubuntu Desktop 20.04.3 with LVM/LUKS during the installation process. If I turn off the computer, is the brute force the only attack available for getting the password and accessing the ...
Chris Garcia's user avatar
1 vote
3 answers
1k views

Which one is safer for persistent online data? Gpg per file encryption vs gpg encrypted image vs LUKS2 image

3 people need to share some data through cloud. The total amount of data is small (<5gb in total). The update rate is very low, 1 per month. The cloud has very limited security measures so we ...
Wang's user avatar
  • 128
2 votes
1 answer
229 views

LibreOffice password vs cryptocontainer (LUKS, VeraCrypt etc.)

How much worse is encrypting a LibreOffice document with the built-in mechanism than using a cryptocontainer (LUKS, VeraCrypt, etc.) and storing the document in it? I am more comfortable using the ...
ClapT's user avatar
  • 21
0 votes
1 answer
126 views

Does an SSD store software-encrypted data in unencrypted form somewhere?

I use LUKS encryption on my entire drive. Do SSD drives ship with any storage areas which store unencrypted data, even though the data is saved encrypted on user-available SSD storage? Maybe inside ...
CurtisB's user avatar
  • 33
1 vote
1 answer
129 views

Does filesystem compression aid cryptanalysis?

I use LUKS to encrypt all sensitive data on my computer. If I switch to using a filesystem with on-the-fly data compression such as ZFS, should I use its compression feature together with LUKS? Does ...
CurtisB's user avatar
  • 33
0 votes
2 answers
869 views

Is it unsecure to use only a passphrase in luks for whole system partition encryption?

When i use only a passphrase in luks for my whole system partition encryption, so i need to insert a password to decrypt my system partition to boot up my os, is this unsecure and can it be cracked ...
Z0OM's user avatar
  • 119
1 vote
1 answer
636 views

LUKS: longer passphrase iteration count

From the manual of cryptsetup: Passphrase processing: Whenever a passphrase is added to a LUKS header (luksAddKey, luksFormat), the user may specify how much the time the passphrase processing should ...
Dor's user avatar
  • 111
0 votes
1 answer
106 views

Add directory of Luks partition to system PATH

I would like to keep some secret executable binaries inside a LUKS partition. This partition is not mounted automatically at boot, but only manually in some moments I would like to automatically add a ...
stefd's user avatar
  • 121
0 votes
3 answers
1k views

How difficult is it to decrypt a disk encrypted with luksOpen?

I have encrypted a disk on my Ubuntu machine using sudo cryptsetup luksOpen /dev/sdb1 sdb1 I'm wondering how difficult is it to decrypt this disk using bruteforce password guessing? What does the ...
blnks's user avatar
  • 383
1 vote
0 answers
207 views

Does secure boot prevent evil maid attacks when using LUKS?

When one installs Debian 11 with secure-boot enabled, is computer protected against evil maid attacks trying to capture encryption keys using software keylogger? Disk is formatted using defaults which ...
sunknudsen's user avatar
0 votes
1 answer
1k views

is it possible to change luks2 --key-size from 512b to 256b without losing data?

I created luks2 device with default options which used aes-xts with 512b key size.I figured out that 256b is somewhat faster than 512b from benchmarks. So, I just want to use 256b but not sure if it's ...
Akhil's user avatar
  • 105
-1 votes
1 answer
661 views

Just found out about luksDump in LUKS (cryptsetup), Is there a way to hide all these sensitive data like used cipher and hash?

I have been using cryptsetup for a while now and just found out about the option 'luksDump'. I am used to similar tools like veracrypt and truecrypt and I am a bit shocked that all these vulnerable ...
pekosi's user avatar
  • 1
0 votes
1 answer
240 views

Bypass encryption by altering source code

In the Cryptsetup Frequently Asked Questions page it says: You are asked a passphrase of an existing key-slot first, before you can enter the passphrase for the new key-slot. Otherwise you could ...
EmmaV's user avatar
  • 103
0 votes
3 answers
860 views

How good/bad are these transparent Linux consumer FDE setup options? (e.g. for auto-unlocking LUKS)

UPDATED Summary: I'm looking at Linux FDE options that are transparent to the user (my parents) in that the user doesn't need to enter 2 passwords. I found/thought of several options and tried to ...
zpangwin's user avatar
  • 331
20 votes
3 answers
13k views

Is LUKS still an effective option for consumer FDE considering Elcomsoft can break it?

I use Fedora Linux and was recently looking into doing Full Disk Encryption on data drives such as /home on some of my / my family's PCs. I understand that LUKS security will be partially dependent on ...
zpangwin's user avatar
  • 331
1 vote
1 answer
2k views

Linux/LUKS/Full Disk Encryption: How can I mitigate SSD/flash media security security risk caused by unreliable physical deletion?

Firstly, I do not think my question is answered by SSD full disk encryption as I am not looking for a binary "is FDE secure" - nothing is perfectly secure; rather I am looking for possible ...
hut_rudder's user avatar
1 vote
1 answer
390 views

Security against local attack for remote FDE decryption?

Is there any remote FDE decryption that is resistant to an attacker that has local physical access? Tools like dracut-sshd need to store the private key used for the sshd server on the unencrypted ...
Dannycy's user avatar
  • 21
0 votes
1 answer
810 views

Do LUKS2 encrypted partitions with Keyfiles use a KDF?

I gather from the cryptsetup manpages that LUKS2 uses argon2i by default for strengthening a user-password to decrypt the partition. However if a 256 bit keyfile with data from /dev/random, how does a ...
jaaq's user avatar
  • 125
1 vote
1 answer
2k views

Is it secure to automatically unlock encrypted system drive using the TPM PCR values?

A simple way of automatically decrypting system drive at boot time: clevis luks bind -d /dev/yourdrive tpm2 '{"pcr_ids":"4,5"}' systemctl enable clevis-luks-askpass.path When I ...
Gravitysensation's user avatar
2 votes
1 answer
922 views

dm-crypt 2.0.3 + luks: salt auto-generated? what affects decryption speed?

I am trying to encrypt one of my primary Linux partition (5GB) by following this example to encrypt. I want to confirm some of my understandings: Salt is automatically generated by cyrptsetup with ...
HCSF's user avatar
  • 153
1 vote
0 answers
398 views

Better security for storing certificates in LUKS or softhsm?

What is the best place to store certificates and keys which are confidential and sensitive? As I understand LUKS is fine and kernel transparently handles encryption/decryption. Also, the LUKS volume ...
Baranikumar Venkatesan's user avatar
3 votes
1 answer
469 views

Can I secure the bootloader without a TPM?

I have a lot of PCs without a TPM installed. Buying TPMs for all of them is not an option, but I still want to do encryption on them. From what I've studied so far, the entire system/boot partition ...
Livy's user avatar
  • 133
0 votes
0 answers
2k views

How to find the encrypted master key in LUKS header

One assignement of my teacher is driving me crazy because I don't think I'm that far from the solution but I still can't get it so I hope someone will be able to help me figure it out. Assignment The ...
Ripitchip's user avatar
0 votes
0 answers
1k views

How secure is LUKS encryption?

I have encrypted a hardsik with a 12 charachter random alphanumeric passwrod using LUKS encryption on Ubuntu 18.04 on a 2.5" SATA disk partitioned with ext4. I'm wondering how secure is such ...
randon's user avatar
  • 437
1 vote
0 answers
210 views

Entered FDE password in GRUB by mistake

For several reasons (I have an external monitor, etc.) when I booted the laptop I typed the FDE (Full Disk Encryption on Linux, LUKS) without looking at the monitor, and I ended up typing the full ...
reed's user avatar
  • 15.8k
1 vote
0 answers
160 views

Backing-up to an untrusted cloud

Not sure if this kind of review/validation question is allowed - please delete if it isn't. Like many before, I'm looking for ways to do cloud backup in a way where I trust that I'm still the only one ...
jmr's user avatar
  • 111
0 votes
1 answer
578 views

Full disk encryption and remote unlocking a mail server in the hand of a possible attacker, what could go wrong?

Since I cannot receive email directly from my home server, I need an external device to receive messages for me and deliver them to my MTA via another port or via VPN. Instead of renting a VPS just ...
Polizi8's user avatar
  • 163
0 votes
1 answer
366 views

Is there any added benefit to using a random keyfile of more than 512 bits?

Most of the online guides I found about using dm-crypt with a random keyfile use files bigger than 512 bits (64 bytes). For example: dd bs=512 count=4 if=/dev/urandom of=keyfile iflags=fullblock As ...
Hauyz's user avatar
  • 11
3 votes
4 answers
4k views

How safe is dm-crypt/LUKS? Would TPM make me more secure in this case?

I’ve been looking to purchase a new laptop and I need to have security in mind. I’ve specifically been looking for laptops with discrete or integrated TPM because it’s been my understanding that TPM ...
arrakies's user avatar
2 votes
1 answer
1k views

ZFS on LUKS2 encrypted device: LuksFormat with or without dm-integrity?

Does it make sense to combine ZFS with LUKS2 for completely random-looking encryption on HDDs ? (Without luks-header on the disk of course, header placed elsewhere). The goal is to make a HDD really ...
Vortex's user avatar
  • 21
3 votes
3 answers
274 views

Drawback of Multi Level Encryption

I am backing up my files to a RAID mirrored HDD, that has full disk encryption (FDE) in place with LUKS. Until now I did this with rsync, but I recently switched to a new backup program that does file ...
JJ Abrams's user avatar
  • 131
0 votes
1 answer
1k views

What kind of "actions" can a TPM2 policy authorize?

I've been instructed to use the state of our system's TPM's PCR registers to prevent the system we're working on from booting if one of the PCR registers is different from what we expect. In service ...
user1733212's user avatar
48 votes
4 answers
16k views

Aren't keyfiles defeating the purpose of encryption?

I just added a drive to my system which is basically a partition mounted for extra storage. I'd like to encrypt it to protect my data in case of god knows what, and by doing that I'd need to enter the ...
php_nub_qq's user avatar
3 votes
1 answer
746 views

LUKS - Too large detached header size when large offset

I find cryptsetup to have an inconsistent way of dealing with headers, I'm tempted to call it a bug I would like to achieve a very large LUKS offset without resulting in a very bulky detached header ...
adnev's user avatar
  • 31
2 votes
1 answer
594 views

Storing LUKS master key in SGX enclave

Is it possible to store the master decryption key for accessing a LUKS encrypted volume inside an SGX enclave so that the master key cannot be accessed by any user on the system, even the root user ...
Michael Altfield's user avatar
1 vote
1 answer
479 views

Why is my LUKS header listed twice?

Why is the metadata in my LUKS header listed twice? I started poking at the bits in a drive that's encrypted with LUKS, and I found some metadata in a JSON object. What's odd though is that the same ...
Michael Altfield's user avatar
1 vote
1 answer
332 views

What is a LUKS cipher-name "@"?

In analyzing the LUKS header on an encrypted volume, the cipher-name field shows a single-character = '@'. What does that mean? The LUKS On-Disk Format Specification originally published by Clemens ...
Michael Altfield's user avatar
2 votes
1 answer
4k views

How to determine start and end bytes of LUKS header?

How can I determine the exact start byte and exact end byte of a LUKS header on a block storage device? I use Linux Unified Key Setup (LUKS) for Full Disk Encryption (FDE), so all of the data on my ...
Michael Altfield's user avatar
1 vote
1 answer
293 views

Stealing Veracrypt or LUKS hash while system running?

If a hacker gains access to an encrypted system (Veracrypt, LUKS or any other software) via the internet while the system is running - can they steal the hash from RAM and later use that hash to ...
kat's user avatar
  • 411
0 votes
0 answers
562 views

Possible to restore LUKS header from partition that uses the exact same password and keyfile?

I was in Windows 10 and it told me I needed to Initialize Disk so I clicked it and now my LUKS header has been overwritten. I created my encrypted partitions in Linux with cryptsetup command. However, ...
Anon User's user avatar