Questions tagged [luks]
LUKS (Linux Unified Key Setup) is a disk-encryption specification.
152 questions
3
votes
1
answer
742
views
Any information on the encrypted Knoppix user data file system (knoppix-data.aes)?
I remember about 90% of my password used for encrypting the persistent user data file system (stored as knoppix-data.aes) while setting up Knoppix a few years ago and would now like to explore the ...
- 33
2
votes
1
answer
270
views
Recovering LUKS Encrypted Data
Its a tale as old as full-disk encryption. Another victim of complicated passwords succumbs to LUKS on the Linux system.
I recently changed my LUKS encrypted drive password on a laptop, but my laptop ...
- 21
4
votes
0
answers
111
views
Is it possible to know when my TPM was last used to decrypt my disk?
I use Linux on my laptop and I do Full Disk Encryption with the LUKS keys enrolled into TPM2 against proper PCRs to make sure firmware, UEFI and Secure Boot setup are in a known-good state. ...
0
votes
1
answer
160
views
luks increase delays between password attempts
From what I understand, argon provides a delay between password attempts. Does luks allow increasing or reducing the delay?
3
votes
2
answers
1k
views
LUKS: How many iterations are enough?
The luksFormat command accepts iteration time as a parameter, not iterations. That obviously leads to quite different number of iterations depending on the hardware doing the encryption. However if ...
- 435
1
vote
1
answer
325
views
Using TPM to unlock LUKS/dm-crypt volume
I am trying to understand the risks of configuring passwordless decryption via TPM of a LUKS/dm-crypt system with something like:
systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=0+1+2+3+4+5+7+8 /...
- 261
0
votes
1
answer
117
views
Is deploying a web application to a customer's encrypted drive a secure solution against code theft?
I have developed a web service for customer. The web service is written in Python and running in Docker containers. It is managed by docker compose.
The customer wants my web service to run on their ...
1
vote
1
answer
1k
views
How does a TPM module protect keys LUKS keys on Linux
I'm looking into hardening an embedded device using TPM2 with an encrypted root (/) Linux partition. I've found various articles explaining how to embed LUKS keys into the TPM (eg this one). Unless ...
- 111
0
votes
1
answer
1k
views
LUKS brute force risk?
If a person finds an old hard drive that was partially overwritten and let's say 1GB of that wasn't and was formerly used for part of a LUKS encrypted partition, what is the risk that such data, which ...
- 1
0
votes
1
answer
237
views
Remote Laptop disk encryption, break glass
I am stuck with an issue of needing a break glass account on remote laptops.
It's a bit a strange situation. The laptops are built and rebuilt remotely using a small PXE setup that goes with the ...
- 1
0
votes
1
answer
246
views
Does faulTPM defeat the LUKS-based FDE with a passphrase?
The recent faulTPM paper (https://arxiv.org/pdf/2304.14717v1.pdf) deals mostly with Bitlocker and only mentions LUKS to note the differences.
The authors state:
With a passphrase, however, the same ...
- 249
1
vote
2
answers
612
views
Full disk encryption with LUKS?
I encrypted my Ubuntu Desktop 20.04.3 with LVM/LUKS during the installation process. If I turn off the computer, is the brute force the only attack available for getting the password and accessing the ...
- 11
1
vote
3
answers
1k
views
Which one is safer for persistent online data? Gpg per file encryption vs gpg encrypted image vs LUKS2 image
3 people need to share some data through cloud. The total amount of data is small (<5gb in total). The update rate is very low, 1 per month. The cloud has very limited security measures so we ...
- 158
2
votes
1
answer
263
views
LibreOffice password vs cryptocontainer (LUKS, VeraCrypt etc.)
How much worse is encrypting a LibreOffice document with the built-in mechanism than using a cryptocontainer (LUKS, VeraCrypt, etc.) and storing the document in it?
I am more comfortable using the ...
- 21
0
votes
1
answer
142
views
Does an SSD store software-encrypted data in unencrypted form somewhere?
I use LUKS encryption on my entire drive. Do SSD drives ship with any storage areas which store unencrypted data, even though the data is saved encrypted on user-available SSD storage?
Maybe inside ...
- 43
1
vote
1
answer
137
views
Does filesystem compression aid cryptanalysis?
I use LUKS to encrypt all sensitive data on my computer. If I switch to using a filesystem with on-the-fly data compression such as ZFS, should I use its compression feature together with LUKS? Does ...
- 43
1
vote
2
answers
1k
views
Is it unsecure to use only a passphrase in luks for whole system partition encryption?
When I use only a passphrase in LUKS for my whole system partition encryption, so I need to insert a password to decrypt my system partition to boot up my OS, is this unsecure and can it be cracked ...
- 129
1
vote
1
answer
710
views
LUKS: longer passphrase iteration count
From the manual of cryptsetup:
Passphrase processing: Whenever a passphrase is added to a LUKS header
(luksAddKey, luksFormat), the user may specify how much the time the
passphrase processing should ...
- 111
0
votes
1
answer
118
views
Add directory of Luks partition to system PATH
I would like to keep some secret executable binaries inside a LUKS partition.
This partition is not mounted automatically at boot, but only manually in some moments
I would like to automatically add a ...
- 121
0
votes
3
answers
2k
views
How difficult is it to decrypt a disk encrypted with luksOpen?
I have encrypted a disk on my Ubuntu machine using
sudo cryptsetup luksOpen /dev/sdb1 sdb1
I'm wondering how difficult is it to decrypt this disk using bruteforce password guessing?
What does the ...
- 383
1
vote
0
answers
238
views
Does secure boot prevent evil maid attacks when using LUKS?
When one installs Debian 11 with secure-boot enabled, is computer protected against evil maid attacks trying to capture encryption keys using software keylogger?
Disk is formatted using defaults which ...
- 229
0
votes
1
answer
2k
views
is it possible to change luks2 --key-size from 512b to 256b without losing data?
I created luks2 device with default options which used aes-xts with 512b key size.I figured out that 256b is somewhat faster than 512b from benchmarks. So, I just want to use 256b but not sure if it's ...
- 105
-1
votes
1
answer
816
views
Just found out about luksDump in LUKS (cryptsetup), Is there a way to hide all these sensitive data like used cipher and hash?
I have been using cryptsetup for a while now and just found out about the option 'luksDump'. I am used to similar tools like veracrypt and truecrypt and I am a bit shocked that all these vulnerable ...
- 1
0
votes
1
answer
283
views
Bypass encryption by altering source code
In the Cryptsetup Frequently Asked Questions page it says:
You are asked a passphrase of an existing key-slot first, before you can enter the passphrase for the new key-slot. Otherwise you could ...
- 103
0
votes
3
answers
949
views
How good/bad are these transparent Linux consumer FDE setup options? (e.g. for auto-unlocking LUKS)
UPDATED Summary: I'm looking at Linux FDE options that are transparent to the user (my parents) in that the user doesn't need to enter 2 passwords. I found/thought of several options and tried to ...
- 331
20
votes
3
answers
15k
views
Is LUKS still an effective option for consumer FDE considering Elcomsoft can break it?
I use Fedora Linux and was recently looking into doing Full Disk Encryption on data drives such as /home on some of my / my family's PCs. I understand that LUKS security will be partially dependent on ...
- 331
2
votes
1
answer
2k
views
Linux/LUKS/Full Disk Encryption: How can I mitigate SSD/flash media security security risk caused by unreliable physical deletion?
Firstly, I do not think my question is answered by SSD full disk encryption as I am not looking for a binary "is FDE secure" - nothing is perfectly secure; rather I am looking for possible ...
- 21
1
vote
1
answer
423
views
Security against local attack for remote FDE decryption?
Is there any remote FDE decryption that is resistant to an attacker that has local physical access?
Tools like dracut-sshd need to store the private key used for the sshd server on the unencrypted ...
- 21
0
votes
1
answer
891
views
Do LUKS2 encrypted partitions with Keyfiles use a KDF?
I gather from the cryptsetup manpages that LUKS2 uses argon2i by default for strengthening a user-password to decrypt the partition. However if a 256 bit keyfile with data from /dev/random, how does a ...
- 125
1
vote
1
answer
2k
views
Is it secure to automatically unlock encrypted system drive using the TPM PCR values?
A simple way of automatically decrypting system drive at boot time:
clevis luks bind -d /dev/yourdrive tpm2 '{"pcr_ids":"4,5"}'
systemctl enable clevis-luks-askpass.path
When I ...
2
votes
1
answer
1k
views
dm-crypt 2.0.3 + luks: salt auto-generated? what affects decryption speed?
I am trying to encrypt one of my primary Linux partition (5GB) by following this example to encrypt.
I want to confirm some of my understandings:
Salt is automatically generated by cyrptsetup with ...
- 153
1
vote
0
answers
457
views
Better security for storing certificates in LUKS or softhsm?
What is the best place to store certificates and keys which are confidential and sensitive?
As I understand LUKS is fine and kernel transparently handles encryption/decryption. Also, the LUKS volume ...
3
votes
1
answer
564
views
Can I secure the bootloader without a TPM?
I have a lot of PCs without a TPM installed. Buying TPMs for all of them is not an option, but I still want to do encryption on them.
From what I've studied so far, the entire system/boot partition ...
- 133
0
votes
0
answers
2k
views
How to find the encrypted master key in LUKS header
One assignement of my teacher is driving me crazy because I don't think I'm that far from the solution but I still can't get it so I hope someone will be able to help me figure it out.
Assignment
The ...
0
votes
0
answers
2k
views
How secure is LUKS encryption?
I have encrypted a hardsik with a 12 charachter random alphanumeric passwrod using LUKS encryption on Ubuntu 18.04 on a 2.5" SATA disk partitioned with ext4.
I'm wondering how secure is such ...
- 437
1
vote
0
answers
230
views
Entered FDE password in GRUB by mistake
For several reasons (I have an external monitor, etc.) when I booted the laptop I typed the FDE (Full Disk Encryption on Linux, LUKS) without looking at the monitor, and I ended up typing the full ...
- 15.9k
1
vote
0
answers
179
views
Backing-up to an untrusted cloud
Not sure if this kind of review/validation question is allowed - please delete if it isn't.
Like many before, I'm looking for ways to do cloud backup in a way where I trust that I'm still the only one ...
- 111
0
votes
1
answer
616
views
Full disk encryption and remote unlocking a mail server in the hand of a possible attacker, what could go wrong?
Since I cannot receive email directly from my home server, I need an external device to receive messages for me and deliver them to my MTA via another port or via VPN. Instead of renting a VPS just ...
- 173
0
votes
1
answer
420
views
Is there any added benefit to using a random keyfile of more than 512 bits?
Most of the online guides I found about using dm-crypt with a random keyfile use files bigger than 512 bits (64 bytes).
For example:
dd bs=512 count=4 if=/dev/urandom of=keyfile iflags=fullblock
As ...
- 11
3
votes
4
answers
4k
views
How safe is dm-crypt/LUKS? Would TPM make me more secure in this case?
I’ve been looking to purchase a new laptop and I need to have security in mind. I’ve specifically been looking for laptops with discrete or integrated TPM because it’s been my understanding that TPM ...
- 41
2
votes
1
answer
1k
views
ZFS on LUKS2 encrypted device: LuksFormat with or without dm-integrity?
Does it make sense to combine ZFS with LUKS2 for completely random-looking encryption on HDDs ? (Without luks-header on the disk of course, header placed elsewhere). The goal is to make a HDD really ...
- 21
3
votes
3
answers
285
views
Drawback of Multi Level Encryption
I am backing up my files to a RAID mirrored HDD, that has full disk encryption (FDE) in place with LUKS. Until now I did this with rsync, but I recently switched to a new backup program that does file ...
- 131
0
votes
1
answer
2k
views
What kind of "actions" can a TPM2 policy authorize?
I've been instructed to use the state of our system's TPM's PCR registers to prevent the system we're working on from booting if one of the PCR registers is different from what we expect. In service ...
- 21
48
votes
4
answers
16k
views
Aren't keyfiles defeating the purpose of encryption?
I just added a drive to my system which is basically a partition mounted for extra storage. I'd like to encrypt it to protect my data in case of god knows what, and by doing that I'd need to enter the ...
- 787
3
votes
1
answer
841
views
LUKS - Too large detached header size when large offset
I find cryptsetup to have an inconsistent way of dealing with headers, I'm tempted to call it a bug
I would like to achieve a very large LUKS offset without resulting in a very bulky detached header
...
- 31
2
votes
1
answer
631
views
Storing LUKS master key in SGX enclave
Is it possible to store the master decryption key for accessing a LUKS encrypted volume inside an SGX enclave so that the master key cannot be accessed by any user on the system, even the root user ...
- 1,098
1
vote
1
answer
550
views
Why is my LUKS header listed twice?
Why is the metadata in my LUKS header listed twice?
I started poking at the bits in a drive that's encrypted with LUKS, and I found some metadata in a JSON object. What's odd though is that the same ...
- 1,098
1
vote
1
answer
359
views
What is a LUKS cipher-name "@"?
In analyzing the LUKS header on an encrypted volume, the cipher-name field shows a single-character = '@'. What does that mean?
The LUKS On-Disk Format Specification originally published by Clemens ...
- 1,098
2
votes
1
answer
4k
views
How to determine start and end bytes of LUKS header?
How can I determine the exact start byte and exact end byte of a LUKS header on a block storage device?
I use Linux Unified Key Setup (LUKS) for Full Disk Encryption (FDE), so all of the data on my ...
- 1,098
1
vote
1
answer
319
views
Stealing Veracrypt or LUKS hash while system running?
If a hacker gains access to an encrypted system (Veracrypt, LUKS or any other software) via the internet while the system is running - can they steal the hash from RAM and later use that hash to ...
- 411