Questions tagged [luks]
LUKS (Linux Unified Key Setup) is a disk-encryption specification.
1
vote
1answer
71 views
Is suspend-to-ram really a meaningful risk for Full Disk Encryption?
Ubuntu offers full disk encryption relying on luks. An often recurring area of criticism is the fact that Ubuntu disables hibernation by default while suspend-to-ram stores the private keys in the ram ...
0
votes
1answer
47 views
security of cryptsetup(8) luksRemoveKey, feasibility of extracting MasterSecretKey and using it later
I looked at https://crypto.stackexchange.com/a/24024 and it seems to me cryptsetup(8) luksRemoveKey is weak.
The situation:
I create new LUKS volume, copy stuff into it.
I add a new pass phrase, and ...
1
vote
1answer
75 views
Is it possible to LUKS require both password and key file?
My goal is to be able easily destroy medium with key file in emergency situation and make system unbootable, even is potential advisor knows right password for the system. I'd store this key file in ...
0
votes
1answer
106 views
dm-crypt/LUKS: one-time password
I've setup arch using dm-crypt / luks, with a passphrase and a key, lost one of them will fail to login.
But I feel I need more secure of passphrase, how to setup dm-crypt / luks that has one-time ...
3
votes
1answer
71 views
Can information somehow be secured from the host on a KVM guest?
With KVM guest systems so prevalent now, I was wondering if there is any merit in using LUKS encrypted storage, as the guest will usually be always on, so the information is always accessible ...
1
vote
2answers
53 views
Using command (dd if=/dev/mmcblk0p1 | sha1sum) while running from initramfs
I have an opensource airgapped raspberry pi project seen at the following link: www.privatekeyvault.com
I have provided a method for installing LUKS full disk encryption seen at the following: https:/...
0
votes
1answer
43 views
Security/Privacy OS With Boot On Thumbdrive
I am looking for a security-centered Linux OS that allows you to take the /boot partition on a thumb-drive to alleviate concerns of an Evil Maid Attacks! What OS is it easy to remove the /boot ...
2
votes
4answers
153 views
Are multiple encrypted containers with the same passphase containing the same files a cryptographic risk?
Situation as follows:
Let's assume two (or more) containers, encrypted using the same passphrase.
They will contain the same files. So their content is identical.
However, (from "outside") the ...
1
vote
0answers
100 views
Automatic fetch Luks keyfile over ssh and decrypt partition [closed]
I run a small computer with an encrypted data partition.
So that I have as little effort as possible to decrypt the hard disk after a reboot (no extra ssh login, password input etc.), I thought about ...
4
votes
1answer
150 views
Does full disk encryption offer mitigation in the case of the firmware of an SSD being compromised?
Suppose the firmware of an SSD or HDD has been compromised by rogue actors either through "interdiction" (interception) or via the internet. They are able to exfiltrate data and conduct surveillance ...
0
votes
2answers
172 views
How does default Debian boot drive encryption works?
When installing Debian, I chose an option to create Encrypted LVM (Logical Volume Management). So now, when I turn on my PC, it asks me for an encryption password.
It looks ok, but how does it work? ...
5
votes
1answer
593 views
Use TPM2.0 to securely decrypt the hard drive in Linux — unattended
I already spent several days trying to figure out how to securely decrypt a hard drive on remote location using TPM2.0 in Linux. I'm no security expert and this is my first battle with TPM2.0. I ...
-1
votes
1answer
346 views
Full disk encryption vs file based encryption
I need to protect a few hundred thousand files stored on a drive on a Linux server. I am thinking full disk encryption with file encryption on top would be the best option. Failing that, file based ...
2
votes
1answer
83 views
Can government authorities retrieve data from LUKS volume when it's accessed while turned on? [duplicate]
I've heard that there are attacks that can get passwords out of RAM while turned on.
If a server, CentOS 7.5 and LUKS enabled, it's tty1 locked, which is on a VMWare hypervisor that is locked with a ...
5
votes
2answers
268 views
Luks+Sleep: Login screen security?
Situation: A Desktop Linux (eg. Debian, Xfce desktop, Lightdm login) with LUKS-encrypted partitions (as far as possible, eg. Efi files are not encrypted of course).
The computer is in sleep mode (not ...
2
votes
1answer
689 views
LUKS2 dm-integrity
I am using Debian 9.5, kernel 9.16, I would like to use the dm-integrity feature with cryptsetup.
cryptsetup luksFormat --type luks2 <device> --cipher aes-gcm-random --integrity aead
...
0
votes
1answer
92 views
dmcryt_write process in TOP but no WRDSK indicated
I am using LUKS over RAID0. I have executed cryptsetup -v --cipher aes-xts-plain64 --key-size 512 --hash sha256 --iter-time 2000 --use-urandom --verify-passphrase luksFormat /dev/md0
Everything ...
1
vote
1answer
315 views
If a LUKS encrypted VM is put in saved state, will the master key be in clear on the host?
Let's assume the host is not encrypted, and all files on it are accessible. A VM with LUKS encryption is saved, meaning its memory is now residing as a regular file on the host, does that memory also ...
2
votes
1answer
81 views
recommendation to change encrypted-drive passphrases
There are numerous recommendations for how frequently to change users' passphrases, and I think the most recent NIST recommendation is "no minimum time to change passwords" (I might be mis-quoting). ...
7
votes
1answer
218 views
Automatically Open LUKS Container on System Boot in a safe manner
I have a linux system running at a cloud provider where I created an encrypted container using LUKS to store personal data.
The encrypted container is manually mounted at /srv; the rest of the ...
2
votes
1answer
637 views
Limit of 256 bit drive encryption? 512 needed for large drives?
I am building an encrypted NAS with 4 x 4TB hard drives and was wondering what the limit of 256 bit AES is when implemented via cryptsetup and luksFormat. As I understand it, the maximum plaintext ...
3
votes
1answer
1k views
LUKS2 on-disk format specifications
The LUKS1 format has been available for a long time, and the format specifications are easy to find. Recently, LUKS2 has been released, which features a number of important changes, such as AEAD and ...
2
votes
1answer
101 views
Wiping data properly in LUKS encrypted drive
Is it enough just to remove the header of LUKS device to wiping (unrecognizable) the data completely? Or it is recoverable (I don't want to recover though)? I need some safeguard to wiping my ...
1
vote
3answers
987 views
If I switch to LUKS on an SSD, have I just wiped it?
I have been using an SSD with no system-level encryption. If I now switch to full disk encryption using LUKS + LVM, do I effectively wipe the old data, or is it still hanging around until overwritten?
1
vote
3answers
216 views
How secure is my logged out but not shut down luks HD
I'am running a Ubuntu 16.04 on a luks encrypted disk. Normally when I leave my machine for some minutes, I always shut it down to be safe with the luks encryption. But I wonder, what the possible ...
3
votes
1answer
249 views
What’s the security risk when setting the Gnome keyring password to blank on an FED system with autologin?
My system disk is full encrypted with luks. My Ubuntu logs in automatically, because I am the only user. But I still need to unlock my Gnome Keyring and I wonder, if there is any sense for that. ...
1
vote
1answer
310 views
LUKS overwrite empty disk space question
I have a question about LUKS and the overwrite empty disk space option. I know what it does, and why people use it but I have a question about it. Forgive me if this question is dumb, it's just ...
1
vote
1answer
189 views
What information can be found about a LUKS-encrypted drive?
Let's say someone found a USB drive at their home and wants to try to figure out what it is (and they don't know the encryption phrase). What information could be determined about this encrypted drive,...
2
votes
1answer
381 views
Resetting LUKS password from CLI with the recovery key
I have a dd of a computer which has a LUKS-encrypted partition. I do not have the password but I do have a recovery key which would allow me to change the password through a GUI interface when the ...
5
votes
2answers
707 views
Why does LUKS use CBC?
I read that LUKS uses 256-bit AES with CBC by default. CBC, of course, has the disadvantages that if you change something in the plain text, you have to change everything that comes after it. In the ...
1
vote
3answers
95 views
Security of different Filesystems
Are there any preferred filesystems that have some boni regarding security and confidentiality? Or does it really not matter if I, for example, encrypt a HDD with LUKS?
As an example, I read that the ...
1
vote
1answer
235 views
cryptsetup luksHeaderBackup file smaller than Payload Offset?
I created test LUKs container in a file, the luksDump says
MK bits: 256
Payload offset: 4096
implying that the header is 4096*512 = 2MiB
but the file produced by
cryptsetup ...
0
votes
1answer
264 views
Preventing LUKS key dump
Is it possible to prevent a root user (user space) from running dmsetup table --showkeys to dump the LUKS master key?
I know of the TRESOR patch which essentially prevents the key from persisting in ...
5
votes
1answer
85 views
Does mounting a LUKS partition authenticate it?
Can I be sure that the (unencrypted) contents of my LUKS volume were not tampered with if it accepts my passhprase on an otherwise trusted system?
In other words, can an attacker with access to my ...
0
votes
1answer
306 views
Access encrypted files (dm-crypt/LUKS) through web app
I'm a newbie to encryption issues and I'm trying to sort out a few questions.
For a distributed application we need to deploy a server outside of our company with sensitives PDF files on it. That ...
0
votes
1answer
144 views
Mapping of encrypted to decrypted blocks in LUKS
Section 2.4 What is the difference between "plain" and LUKS format? of the cryptsetup Frequently Asked Questions says the primary advantage of plain dm-crypt (no LUKS) is:
...high resilience to ...
1
vote
2answers
439 views
Is deleting LUKS keys during operation a good way to protect my data?
Let's say Alice owns a server that stores highly sensitive data. Let's further assume the data is worth a lot, but losing all data is way less of a problem than having it read by attacker Mallet.
To ...
3
votes
1answer
276 views
Is scrubbing a ssd drive effective in situations where you can't use the trim command?
I have a luks encrypted external usb ssd drive (Samsung T3) which is unable to use the trim command. This leaves me to search for a different way to securely erase the free space inside the encrypted ...
1
vote
2answers
2k views
Is LUKS effective?
I ask this because encrypting an hard drive using LUKS takes a few seconds while encrypting the same drive using Bitlocker takes several hours. Does that mean LUKS encryption is weaker?
1
vote
1answer
1k views
How does LUKS work? [closed]
I was just curious if someone had a high level overview of how a system like LUKS worked for full disk encryption, aka. how it stores keys and how those keys are verified, and if data is de-crypted by ...
6
votes
1answer
968 views
Differences between LUKS and Veracrypt
These two FDE solutions are similar, but I noticed different executions speed: specially mounting a device it seems that Veracrypt takes more time decrypting it.
So I would like to compare it with ...
0
votes
2answers
561 views
Is wiping LUKS header needed?
So I previously had an encrypted install of Debian, and wanted to install a new distro with full system encryption again. Now I understand that you don't need to fill the disk with random data if you ...
0
votes
0answers
207 views
Is using passfifo secure if I don't want my passphrase to be captured?
This article indicates how to decrypt remotely a LUKS partition using passfifo.
Quote:
ssh -o "UserKnownHostsFile=~/.ssh/known_hosts.initramfs" \
-i "~/.ssh/id_rsa.initramfs" root@remote.server \
"...
2
votes
1answer
6k views
How to crack encrypted disk (crypto-LUKS) in an efficient way?
I had a disk encrypted by crypto-LUKS but forgotten password.
I read a question posted here. LUKS HDD Encryption crack
But before that I want to know if there's some free software I can use to ...
3
votes
1answer
2k views
Is using trim on a ssd with LVM LUKS safe?
I know that it can allow an attacker to know the filesystem and file size, but can it allow an attacker to decrypt any files?
19
votes
1answer
21k views
Right way to use the TPM for full disk encryption
I'm currently setting up a BitLocker equivalent using a TPM and LUKS. I've got the basics right and I'm able to measure the boot process and seal the FDE key using the TPM.
Every time the sensitive ...
3
votes
1answer
1k views
Change LUKS encryption key (not passphrase) without dataloss
You can change the LUKS passphrase without dataloss, but can you also change the actual key?
I reckon you would have to re-encrypt the whole disk, but that would be acceptable to me.
Background
We ...
0
votes
2answers
793 views
Best way to make a Linux install tamper proof
Good day, I am currently planning an environment where it comes down to the biggest security risk being to boot to another environment and tamper with the install on the disk (Older PCs with physical ...
3
votes
1answer
206 views
How can AES-CBC be used for LUKS encryption, when the ciphertext is not static?
In CBC mode of operation, ciphertext from previous block is used as IV in next block. How then can AES-CBC be used for disk encryption (LUKS), when the data on the disk (ie the ciphertext) keeps ...
1
vote
1answer
414 views
Forget LUKS password after mounting or lock LUKS partition when unmounted
When I unmount a LUKS partition using Nautilus, it gets unmounted and locked.
Using the command-line, I have to:
sudo cryptsetup luksClose encrypted_volume
after unmount, otherwise, re-mounting the ...
