Questions tagged [luks]
LUKS (Linux Unified Key Setup) is a disk-encryption specification.
111
questions
0
votes
1answer
48 views
What kind of “actions” can a TPM2 policy authorize?
I've been instructed to use the state of our system's TPM's PCR registers to prevent the system we're working on from booting if one of the PCR registers is different from what we expect. In service ...
0
votes
0answers
18 views
Deferring AEAD setup on large disks in LUKS2
When setting up LUKS2 using an AEAD mode on a large disk (5+TB), it can take well over a day to add an authentication tag to every block, especially given the slower nature of AEAD algorithms (for now)...
44
votes
4answers
13k views
Aren't keyfiles defeating the purpose of encryption?
I just added a drive to my system which is basically a partition mounted for extra storage. I'd like to encrypt it to protect my data in case of god knows what, and by doing that I'd need to enter the ...
1
vote
0answers
100 views
LUKS - Too large detached header size when large offset
I find cryptsetup to have an inconsistent way of dealing with headers, I'm tempted to call it a bug
I would like to achieve a very large LUKS offset without resulting in a very bulky detached header
...
2
votes
1answer
70 views
Storing LUKS master key in SGX enclave
Is it possible to store the master decryption key for accessing a LUKS encrypted volume inside an SGX enclave so that the master key cannot be accessed by any user on the system, even the root user ...
1
vote
1answer
61 views
Why is my LUKS header listed twice?
Why is the metadata in my LUKS header listed twice?
I started poking at the bits in a drive that's encrypted with LUKS, and I found some metadata in a JSON object. What's odd though is that the same ...
1
vote
1answer
101 views
What is a LUKS cipher-name “@”?
In analyzing the LUKS header on an encrypted volume, the cipher-name field shows a single-character = '@'. What does that mean?
The LUKS On-Disk Format Specification originally published by Clemens ...
0
votes
1answer
113 views
How to determine start and end bytes of LUKS header?
How can I determine the exact start byte and exact end byte of a LUKS header on a block storage device?
I use Linux Unified Key Setup (LUKS) for Full Disk Encryption (FDE), so all of the data on my ...
1
vote
1answer
66 views
Stealing Veracrypt or LUKS hash while system running?
If a hacker gains access to an encrypted system (Veracrypt, LUKS or any other software) via the internet while the system is running - can they steal the hash from RAM and later use that hash to ...
0
votes
0answers
100 views
Possible to restore LUKS header from partition that uses the exact same password and keyfile?
I was in Windows 10 and it told me I needed to Initialize Disk so I clicked it and now my LUKS header has been overwritten. I created my encrypted partitions in Linux with cryptsetup command. However, ...
0
votes
1answer
98 views
Have I used LUKS properly?
I am about to go travelling to some high risk countries where corrupt officials will most likely try to go through my laptop and external HDD.
I am using Linux Mint and LUKS. Could someone please ...
2
votes
0answers
40 views
How to secure remote console LUKS passphrase entry?
Say I have a Linux server running on my own metal and wish to encrypt the hard drive using LUKS.
After a power failure, how can I enter my passphrase remotely without compromising it?
-1
votes
1answer
99 views
LVM on LUKS implementation [closed]
LVM on LUKS is the only secure option for encrypting a Linux/Ubuntu USB system. If someone gets access to an unencrypted USB that's not LVM on LUKS they know what it is and what's on it.
However LVM ...
1
vote
0answers
380 views
Use TPM 2.0 to automatically decrypt the SD Card in Raspbian OS
I'm a college student trying to complete the first part of a rather large project, but I'm new to TPM, and Linux. What I'm trying to do is have TPM handle automatic decryption of the root ext4 ...
0
votes
1answer
131 views
Is the following protocol a good method for encrypting a non-OS hdd? [closed]
I find the following somewhat confusing, but it doesn't have many steps. Is this a solid method for encrypting a hdd with LUKS?
Here’s the process in few steps:
Create a LUKS partition
...
1
vote
1answer
428 views
Are there any risks from cloning a LUKS encrypted partition?
I'm using an installation of Ubuntu server on disk, with some extra packages installed and configuration carried out, on disk as a kind of base image for repeatedly creating other systems. I clone ...
2
votes
3answers
184 views
Should I upgrade old volumes to new cryptsetup encryption mode?
The old cryptsetup default is aes-cbc-essiv:sha256. The new one is aes-xts-plain64:sha256. I don't know that much about cryptography but I assume the standard was changed for a reason.
Also there can ...
2
votes
0answers
42 views
Best luks setup disk [duplicate]
I want to encrypt my disk but I want to know what is the best configuration, I currently use ths:
cryptsetup -v --cipher serpent-xts-plain64 --key-size 512 --key-file=- --hash whirlpool --iter-time ...
1
vote
1answer
148 views
Is double encrypting with AES safe?
Is it safe to encrypt twice with AES, with any mode? Are any combinations of AES, e.g. AES with XTS and AES with CBC, or twice with AES and XTS, more unsafe than just having it encrypted once?
I know ...
3
votes
1answer
230 views
Is suspend-to-ram really a meaningful risk for Full Disk Encryption?
Ubuntu offers full disk encryption relying on luks. An often recurring area of criticism is the fact that Ubuntu disables hibernation by default while suspend-to-ram stores the private keys in the ram ...
0
votes
1answer
124 views
security of cryptsetup(8) luksRemoveKey, feasibility of extracting MasterSecretKey and using it later
I looked at https://crypto.stackexchange.com/a/24024 and it seems to me cryptsetup(8) luksRemoveKey is weak.
The situation:
I create new LUKS volume, copy stuff into it.
I add a new pass phrase, and ...
2
votes
1answer
636 views
Is it possible to LUKS require both password and key file?
My goal is to be able easily destroy medium with key file in emergency situation and make system unbootable, even is potential advisor knows right password for the system. I'd store this key file in ...
0
votes
1answer
288 views
dm-crypt/LUKS: one-time password
I've setup arch using dm-crypt / luks, with a passphrase and a key, lost one of them will fail to login.
But I feel I need more secure of passphrase, how to setup dm-crypt / luks that has one-time ...
3
votes
1answer
193 views
Can information somehow be secured from the host on a KVM guest?
With KVM guest systems so prevalent now, I was wondering if there is any merit in using LUKS encrypted storage, as the guest will usually be always on, so the information is always accessible ...
1
vote
2answers
66 views
Using command (dd if=/dev/mmcblk0p1 | sha1sum) while running from initramfs
I have an opensource airgapped raspberry pi project seen at the following link: www.privatekeyvault.com
I have provided a method for installing LUKS full disk encryption seen at the following: https:/...
0
votes
1answer
60 views
Security/Privacy OS With Boot On Thumbdrive
I am looking for a security-centered Linux OS that allows you to take the /boot partition on a thumb-drive to alleviate concerns of an Evil Maid Attacks! What OS is it easy to remove the /boot ...
2
votes
4answers
302 views
Are multiple encrypted containers with the same passphase containing the same files a cryptographic risk?
Situation as follows:
Let's assume two (or more) containers, encrypted using the same passphrase.
They will contain the same files. So their content is identical.
However, the containers themselves ...
1
vote
0answers
478 views
Automatic fetch Luks keyfile over ssh and decrypt partition [closed]
I run a small computer with an encrypted data partition.
So that I have as little effort as possible to decrypt the hard disk after a reboot (no extra ssh login, password input etc.), I thought about ...
4
votes
1answer
221 views
Does full disk encryption offer mitigation in the case of the firmware of an SSD being compromised?
Suppose the firmware of an SSD or HDD has been compromised by rogue actors either through "interdiction" (interception) or via the internet. They are able to exfiltrate data and conduct surveillance ...
0
votes
2answers
184 views
How does default Debian boot drive encryption works?
When installing Debian, I chose an option to create Encrypted LVM (Logical Volume Management). So now, when I turn on my PC, it asks me for an encryption password.
It looks ok, but how does it work? ...
5
votes
1answer
4k views
Use TPM2.0 to securely decrypt the hard drive in Linux — unattended
I spent several days trying to figure out how to securely decrypt a hard drive on remote location using TPM2.0 in Linux. I'm no security expert and this is my first battle with TPM2.0. I learned a lot,...
-1
votes
1answer
728 views
Full disk encryption vs file based encryption
I need to protect a few hundred thousand files stored on a drive on a Linux server. I am thinking full disk encryption with file encryption on top would be the best option. Failing that, file based ...
2
votes
1answer
189 views
Can government authorities retrieve data from LUKS volume when it's accessed while turned on? [duplicate]
I've heard that there are attacks that can get passwords out of RAM while turned on.
If a server, CentOS 7.5 and LUKS enabled, it's tty1 locked, which is on a VMWare hypervisor that is locked with a ...
6
votes
2answers
633 views
Luks+Sleep: Login screen security?
Situation: A Desktop Linux (eg. Debian, Xfce desktop, Lightdm login) with LUKS-encrypted partitions (as far as possible, eg. Efi files are not encrypted of course).
The computer is in sleep mode (not ...
4
votes
1answer
2k views
LUKS2 dm-integrity
I am using Debian 9.5, Linux Kernel 4.16, I would like to use the dm-integrity feature with cryptsetup.
cryptsetup luksFormat --type luks2 <device> --cipher aes-gcm-random --integrity aead
...
0
votes
1answer
315 views
dmcryt_write process in TOP but no WRDSK indicated
I am using LUKS over RAID0. I have executed cryptsetup -v --cipher aes-xts-plain64 --key-size 512 --hash sha256 --iter-time 2000 --use-urandom --verify-passphrase luksFormat /dev/md0
Everything ...
1
vote
1answer
554 views
If a LUKS encrypted VM is put in saved state, will the master key be in clear on the host?
Let's assume the host is not encrypted, and all files on it are accessible. A VM with LUKS encryption is saved, meaning its memory is now residing as a regular file on the host, does that memory also ...
2
votes
1answer
101 views
recommendation to change encrypted-drive passphrases
There are numerous recommendations for how frequently to change users' passphrases, and I think the most recent NIST recommendation is "no minimum time to change passwords" (I might be mis-quoting). ...
8
votes
1answer
391 views
Automatically Open LUKS Container on System Boot in a safe manner
I have a linux system running at a cloud provider where I created an encrypted container using LUKS to store personal data.
The encrypted container is manually mounted at /srv; the rest of the ...
1
vote
1answer
909 views
Limit of 256 bit drive encryption? 512 needed for large drives?
I am building an encrypted NAS with 4 x 4TB hard drives and was wondering what the limit of 256 bit AES is when implemented via cryptsetup and luksFormat. As I understand it, the maximum plaintext ...
3
votes
1answer
2k views
LUKS2 on-disk format specifications
The LUKS1 format has been available for a long time, and the format specifications are easy to find. Recently, LUKS2 has been released, which features a number of important changes, such as AEAD and ...
2
votes
1answer
163 views
Wiping data properly in LUKS encrypted drive
Is it enough just to remove the header of LUKS device to wiping (unrecognizable) the data completely? Or it is recoverable (I don't want to recover though)? I need some safeguard to wiping my ...
1
vote
3answers
1k views
If I switch to LUKS on an SSD, have I just wiped it?
I have been using an SSD with no system-level encryption. If I now switch to full disk encryption using LUKS + LVM, do I effectively wipe the old data, or is it still hanging around until overwritten?
1
vote
3answers
345 views
How secure is my logged out but not shut down luks HD
I'am running a Ubuntu 16.04 on a luks encrypted disk. Normally when I leave my machine for some minutes, I always shut it down to be safe with the luks encryption. But I wonder, what the possible ...
3
votes
1answer
439 views
What’s the security risk when setting the Gnome keyring password to blank on an FED system with autologin?
My system disk is full encrypted with luks. My Ubuntu logs in automatically, because I am the only user. But I still need to unlock my Gnome Keyring and I wonder, if there is any sense for that. ...
1
vote
1answer
529 views
LUKS overwrite empty disk space question
I have a question about LUKS and the overwrite empty disk space option. I know what it does, and why people use it but I have a question about it. Forgive me if this question is dumb, it's just ...
1
vote
1answer
209 views
What information can be found about a LUKS-encrypted drive?
Let's say someone found a USB drive at their home and wants to try to figure out what it is (and they don't know the encryption phrase). What information could be determined about this encrypted drive,...
2
votes
1answer
794 views
Resetting LUKS password from CLI with the recovery key
I have a dd of a computer which has a LUKS-encrypted partition. I do not have the password but I do have a recovery key which would allow me to change the password through a GUI interface when the ...
5
votes
2answers
1k views
Why does LUKS use CBC?
I read that LUKS uses 256-bit AES with CBC by default. CBC, of course, has the disadvantages that if you change something in the plain text, you have to change everything that comes after it. In the ...
1
vote
3answers
107 views
Security of different Filesystems
Are there any preferred filesystems that have some boni regarding security and confidentiality? Or does it really not matter if I, for example, encrypt a HDD with LUKS?
As an example, I read that the ...
