Questions tagged [luks]

LUKS (Linux Unified Key Setup) is a disk-encryption specification.

Filter by
Sorted by
Tagged with
0 votes
3 answers
92 views

How difficult is it so decrypt a disk encrypted with luksOpen?

I have encrypted a disk on my Ubuntu machine using sudo cryptsetup luksOpen /dev/sdb1 sdb1 I'm wondering how difficult is it to decrypt this disk using bruteforce password guessing? What does the ...
user avatar
  • 383
0 votes
0 answers
32 views

Does secure boot prevent evil maid attacks when using LUKS?

When one installs Debian 11 with secure-boot enabled, is computer protected against evil maid attacks trying to capture encryption keys using software keylogger? Disk is formatted using defaults which ...
user avatar
0 votes
1 answer
172 views

is it possible to change luks2 --key-size from 512b to 256b without losing data?

I created luks2 device with default options which used aes-xts with 512b key size.I figured out that 256b is somewhat faster than 512b from benchmarks. So, I just want to use 256b but not sure if it's ...
user avatar
  • 105
0 votes
0 answers
85 views

In what order should you create the partition table and a LUKS container?

My goal is to fully encrypt my USB drive with LUKS. What's the correct order of encryption? Should I create the partition table or the LUKS container first? Motivation behind would be greatly ...
user avatar
  • 1
0 votes
0 answers
151 views

Changing password on LUKS2 and SSD

Let's say I have password "password" for my drive using LUKS2. And then I change it to something really unguessable. The slot with password is overwritten. But, on SSD it is not really ...
user avatar
-1 votes
1 answer
257 views

Just found out about luksDump in LUKS (cryptsetup), Is there a way to hide all these sensitive data like used cipher and hash?

I have been using cryptsetup for a while now and just found out about the option 'luksDump'. I am used to similar tools like veracrypt and truecrypt and I am a bit shocked that all these vulnerable ...
user avatar
  • 1
0 votes
1 answer
121 views

Bypass encryption by altering source code

In the Cryptsetup Frequently Asked Questions page it says: You are asked a passphrase of an existing key-slot first, before you can enter the passphrase for the new key-slot. Otherwise you could ...
user avatar
  • 103
0 votes
3 answers
389 views

How good/bad are these transparent Linux consumer FDE setup options? (e.g. for auto-unlocking LUKS)

UPDATED Summary: I'm looking at Linux FDE options that are transparent to the user (my parents) in that the user doesn't need to enter 2 passwords. I found/thought of several options and tried to ...
user avatar
  • 321
19 votes
3 answers
7k views

Is LUKS still an effective option for consumer FDE considering Elcomsoft can break it?

I use Fedora Linux and was recently looking into doing Full Disk Encryption on data drives such as /home on some of my / my family's PCs. I understand that LUKS security will be partially dependent on ...
user avatar
  • 321
1 vote
1 answer
663 views

Linux/LUKS/Full Disk Encryption: How can I mitigate SSD/flash media security security risk caused by unreliable physical deletion?

Firstly, I do not think my question is answered by SSD full disk encryption as I am not looking for a binary "is FDE secure" - nothing is perfectly secure; rather I am looking for possible ...
user avatar
1 vote
1 answer
224 views

Security against local attack for remote FDE decryption?

Is there any remote FDE decryption that is resistant to an attacker that has local physical access? Tools like dracut-sshd need to store the private key used for the sshd server on the unencrypted ...
user avatar
  • 21
0 votes
1 answer
310 views

Do LUKS2 encrypted partitions with Keyfiles use a KDF?

I gather from the cryptsetup manpages that LUKS2 uses argon2i by default for strengthening a user-password to decrypt the partition. However if a 256 bit keyfile with data from /dev/random, how does a ...
user avatar
  • 125
1 vote
1 answer
852 views

Is it secure to automatically unlock encrypted system drive using the TPM PCR values?

A simple way of automatically decrypting system drive at boot time: clevis luks bind -d /dev/yourdrive tpm2 '{"pcr_ids":"4,5"}' systemctl enable clevis-luks-askpass.path When I ...
user avatar
1 vote
1 answer
386 views

dm-crypt 2.0.3 + luks: salt auto-generated? what affects decryption speed?

I am trying to encrypt one of my primary Linux partition (5GB) by following this example to encrypt. I want to confirm some of my understandings: Salt is automatically generated by cyrptsetup with ...
user avatar
  • 143
0 votes
0 answers
182 views

Better security for storing certificates in LUKS or softhsm?

What is the best place to store certificates and keys which are confidential and sensitive? As I understand LUKS is fine and kernel transparently handles encryption/decryption. Also, the LUKS volume ...
user avatar
3 votes
1 answer
205 views

Can I secure the bootloader without a TPM?

I have a lot of PCs without a TPM installed. Buying TPMs for all of them is not an option, but I still want to do encryption on them. From what I've studied so far, the entire system/boot partition ...
user avatar
  • 133
0 votes
0 answers
686 views

How to find the encrypted master key in LUKS header

One assignement of my teacher is driving me crazy because I don't think I'm that far from the solution but I still can't get it so I hope someone will be able to help me figure it out. Assignment The ...
user avatar
0 votes
0 answers
713 views

How secure is LUKS encryption?

I have encrypted a hardsik with a 12 charachter random alphanumeric passwrod using LUKS encryption on Ubuntu 18.04 on a 2.5" SATA disk partitioned with ext4. I'm wondering how secure is such ...
user avatar
  • 437
1 vote
0 answers
129 views

Entered FDE password in GRUB by mistake

For several reasons (I have an external monitor, etc.) when I booted the laptop I typed the FDE (Full Disk Encryption on Linux, LUKS) without looking at the monitor, and I ended up typing the full ...
user avatar
  • 15.3k
1 vote
0 answers
104 views

Backing-up to an untrusted cloud

Not sure if this kind of review/validation question is allowed - please delete if it isn't. Like many before, I'm looking for ways to do cloud backup in a way where I trust that I'm still the only one ...
user avatar
  • 111
0 votes
1 answer
381 views

Full disk encryption and remote unlocking a mail server in the hand of a possible attacker, what could go wrong?

Since I cannot receive email directly from my home server, I need an external device to receive messages for me and deliver them to my MTA via another port or via VPN. Instead of renting a VPS just ...
user avatar
  • 23
0 votes
1 answer
188 views

Is there any added benefit to using a random keyfile of more than 512 bits?

Most of the online guides I found about using dm-crypt with a random keyfile use files bigger than 512 bits (64 bytes). For example: dd bs=512 count=4 if=/dev/urandom of=keyfile iflags=fullblock As ...
user avatar
  • 11
3 votes
4 answers
2k views

How safe is dm-crypt/LUKS? Would TPM make me more secure in this case?

I’ve been looking to purchase a new laptop and I need to have security in mind. I’ve specifically been looking for laptops with discrete or integrated TPM because it’s been my understanding that TPM ...
user avatar
2 votes
1 answer
502 views

ZFS on LUKS2 encrypted device: LuksFormat with or without dm-integrity?

Does it make sense to combine ZFS with LUKS2 for completely random-looking encryption on HDDs ? (Without luks-header on the disk of course, header placed elsewhere). The goal is to make a HDD really ...
user avatar
  • 21
3 votes
3 answers
217 views

Drawback of Multi Level Encryption

I am backing up my files to a RAID mirrored HDD, that has full disk encryption (FDE) in place with LUKS. Until now I did this with rsync, but I recently switched to a new backup program that does file ...
user avatar
  • 131
0 votes
1 answer
570 views

What kind of "actions" can a TPM2 policy authorize?

I've been instructed to use the state of our system's TPM's PCR registers to prevent the system we're working on from booting if one of the PCR registers is different from what we expect. In service ...
user avatar
47 votes
4 answers
15k views

Aren't keyfiles defeating the purpose of encryption?

I just added a drive to my system which is basically a partition mounted for extra storage. I'd like to encrypt it to protect my data in case of god knows what, and by doing that I'd need to enter the ...
user avatar
1 vote
1 answer
432 views

LUKS - Too large detached header size when large offset

I find cryptsetup to have an inconsistent way of dealing with headers, I'm tempted to call it a bug I would like to achieve a very large LUKS offset without resulting in a very bulky detached header ...
user avatar
  • 11
2 votes
1 answer
366 views

Storing LUKS master key in SGX enclave

Is it possible to store the master decryption key for accessing a LUKS encrypted volume inside an SGX enclave so that the master key cannot be accessed by any user on the system, even the root user ...
user avatar
1 vote
1 answer
224 views

Why is my LUKS header listed twice?

Why is the metadata in my LUKS header listed twice? I started poking at the bits in a drive that's encrypted with LUKS, and I found some metadata in a JSON object. What's odd though is that the same ...
user avatar
1 vote
1 answer
235 views

What is a LUKS cipher-name "@"?

In analyzing the LUKS header on an encrypted volume, the cipher-name field shows a single-character = '@'. What does that mean? The LUKS On-Disk Format Specification originally published by Clemens ...
user avatar
2 votes
1 answer
2k views

How to determine start and end bytes of LUKS header?

How can I determine the exact start byte and exact end byte of a LUKS header on a block storage device? I use Linux Unified Key Setup (LUKS) for Full Disk Encryption (FDE), so all of the data on my ...
user avatar
1 vote
1 answer
177 views

Stealing Veracrypt or LUKS hash while system running?

If a hacker gains access to an encrypted system (Veracrypt, LUKS or any other software) via the internet while the system is running - can they steal the hash from RAM and later use that hash to ...
user avatar
  • 411
0 votes
0 answers
377 views

Possible to restore LUKS header from partition that uses the exact same password and keyfile?

I was in Windows 10 and it told me I needed to Initialize Disk so I clicked it and now my LUKS header has been overwritten. I created my encrypted partitions in Linux with cryptsetup command. However, ...
user avatar
0 votes
1 answer
160 views

Have I used LUKS properly?

I am about to go travelling to some high risk countries where corrupt officials will most likely try to go through my laptop and external HDD. I am using Linux Mint and LUKS. Could someone please ...
user avatar
2 votes
0 answers
126 views

How to secure remote console LUKS passphrase entry?

Say I have a Linux server running on my own metal and wish to encrypt the hard drive using LUKS. After a power failure, how can I enter my passphrase remotely without compromising it?
user avatar
-1 votes
1 answer
179 views

LVM on LUKS implementation [closed]

LVM on LUKS is the only secure option for encrypting a Linux/Ubuntu USB system. If someone gets access to an unencrypted USB that's not LVM on LUKS they know what it is and what's on it. However LVM ...
user avatar
  • 1
1 vote
0 answers
851 views

Use TPM 2.0 to automatically decrypt the SD Card in Raspbian OS

I'm a college student trying to complete the first part of a rather large project, but I'm new to TPM, and Linux. What I'm trying to do is have TPM handle automatic decryption of the root ext4 ...
user avatar
0 votes
1 answer
235 views

Is the following protocol a good method for encrypting a non-OS hdd? [closed]

I find the following somewhat confusing, but it doesn't have many steps. Is this a solid method for encrypting a hdd with LUKS? Here’s the process in few steps: Create a LUKS partition ...
user avatar
1 vote
1 answer
2k views

Are there any risks from cloning a LUKS encrypted partition?

I'm using an installation of Ubuntu server on disk, with some extra packages installed and configuration carried out, on disk as a kind of base image for repeatedly creating other systems. I clone ...
user avatar
  • 167
3 votes
3 answers
528 views

Should I upgrade old volumes to new cryptsetup encryption mode?

The old cryptsetup default is aes-cbc-essiv:sha256. The new one is aes-xts-plain64:sha256. I don't know that much about cryptography but I assume the standard was changed for a reason. Also there can ...
user avatar
  • 259
2 votes
0 answers
89 views

Best luks setup disk [duplicate]

I want to encrypt my disk but I want to know what is the best configuration, I currently use ths: cryptsetup -v --cipher serpent-xts-plain64 --key-size 512 --key-file=- --hash whirlpool --iter-time ...
user avatar
1 vote
1 answer
444 views

Is double encrypting with AES safe?

Is it safe to encrypt twice with AES, with any mode? Are any combinations of AES, e.g. AES with XTS and AES with CBC, or twice with AES and XTS, more unsafe than just having it encrypted once? I know ...
user avatar
2 votes
1 answer
511 views

Is suspend-to-ram really a meaningful risk for Full Disk Encryption?

Ubuntu offers full disk encryption relying on luks. An often recurring area of criticism is the fact that Ubuntu disables hibernation by default while suspend-to-ram stores the private keys in the ram ...
user avatar
  • 21
0 votes
1 answer
259 views

security of cryptsetup(8) luksRemoveKey, feasibility of extracting MasterSecretKey and using it later

I looked at https://crypto.stackexchange.com/a/24024 and it seems to me cryptsetup(8) luksRemoveKey is weak. The situation: I create new LUKS volume, copy stuff into it. I add a new pass phrase, and ...
user avatar
  • 7,588
4 votes
1 answer
2k views

Is it possible to LUKS require both password and key file?

My goal is to be able easily destroy medium with key file in emergency situation and make system unbootable, even is potential advisor knows right password for the system. I'd store this key file in ...
user avatar
1 vote
1 answer
691 views

dm-crypt/LUKS: one-time password

I've setup arch using dm-crypt / luks, with a passphrase and a key, lost one of them will fail to login. But I feel I need more secure of passphrase, how to setup dm-crypt / luks that has one-time ...
user avatar
3 votes
1 answer
374 views

Can information somehow be secured from the host on a KVM guest?

With KVM guest systems so prevalent now, I was wondering if there is any merit in using LUKS encrypted storage, as the guest will usually be always on, so the information is always accessible ...
user avatar
  • 31
1 vote
2 answers
157 views

Using command (dd if=/dev/mmcblk0p1 | sha1sum) while running from initramfs

I have an opensource airgapped raspberry pi project seen at the following link: www.privatekeyvault.com I have provided a method for installing LUKS full disk encryption seen at the following: https:/...
user avatar
0 votes
1 answer
167 views

Security/Privacy OS With Boot On Thumbdrive

I am looking for a security-centered Linux OS that allows you to take the /boot partition on a thumb-drive to alleviate concerns of an Evil Maid Attacks! What OS is it easy to remove the /boot ...
user avatar