15
votes
What does LUKS header contain?
For your information, I can't answer "Authoritatively" because I am not the author/contributor of LUKS/cryptsetup/dmcrypt but a user. But my answers are following,
What does LUKS header ...
- 1,166
8
votes
access to mounted luks partition by non-root user
TLDR: Mount the filesystem in the user's home directory.
This is not specific to luks since it applies to mounting in general. I have not tested with ext4 but I don't see a reason why it will be ...
- 166
7
votes
access to mounted luks partition by non-root user
For future readers:
Freshly formatted filesystem's root has usually rights of rwxr-xr-x and indeed is writable by root only.
On the first mount, depending on the future use of this partition - ...
6
votes
Accepted
EFI: encrypt ESP
As of right now there don't seem to be any firmware that support encrypted ESPs, but there is little need for that.
Secure boot takes care of checking the signature of whatever EFI application you're ...
- 12.9k
4
votes
Why is plain dm-crypt only recommended for experts?
I feel this should be mentioned, here.
By far the most questions searched about cryptsetup and LUKS problems are from people that have managed to damage the start of their LUKS partitions, the ...
- 61
4
votes
Accepted
Is it unsecure to use only a passphrase in luks for whole system partition encryption?
The security of your filesystem mostly depends on two main things: the algorithms that you are using for encryption and key derivation, and the implementation of those algorithms.
The algorithms that ...
- 81
3
votes
Accepted
dm-crypt 2.0.3 + luks: salt auto-generated? what affects decryption speed?
First of all, your runtime encrypt-decrypt speed will be dependent on how fast your CPU/ core can handle AES, and whether it's implemented in software or on the hardware - the method by which the ...
- 1,135
2
votes
How can I extract the encrypted master key from LUKS header?
Assuming that you can mount the LUKS volume, do this when it is mounted:
$ dmsetup table --showkey myvolume
0 200704 crypt aes-xts-plain64 0ef81...9aef7 0 8:18 4096
The long string is the master ...
- 321
2
votes
What does LUKS header contain?
A lot of answers here only provided information about LUKS1 (released in 2004), so I thought I'd add a reference to LUKS2 (released in 2017).
The LUKS header necessarily contains unencrypted metadata ...
- 1,070
2
votes
Accepted
Access encrypted files (dm-crypt/LUKS) through web app
> Will a java app be able to seamlessly access those files?
Yes, and you don't need sudo for that (NEVER RUN A WEBSERVICE AS ROOT). Once the luks partition is opened and mounted, application ...
- 9,283
2
votes
How safe is dm-crypt/LUKS? Would TPM make me more secure in this case?
If an attacker has physical access to your machine with a cleartext hard drive, he (she) could modify it to spy you (keylogger and so one) quite easily.
If an attacker has physical access to your ...
- 1,348
2
votes
How safe is dm-crypt/LUKS? Would TPM make me more secure in this case?
"should I bother with TPM?"
Yes. Could help you against low-level adversaries and maybe even against the NSA in case it is not backdoored.
"And how safe is dm-crypt/LUKS?"
Safer ...
2
votes
Accepted
security of cryptsetup(8) luksRemoveKey, feasibility of extracting MasterSecretKey and using it later
You are correct, although I wouldn't call luksRemoveKey "weak", it accomplishes what it is meant to. There are plenty of situations where it's easier and quicker to only change the KEK (key encryption ...
- 15.8k
2
votes
Is it unsecure to use only a passphrase in luks for whole system partition encryption?
The luks header and keyslot area is placed at and near the front of the partition. (I believe when you talk about the "header" you're referring to a backup of the header, which you should ...
- 1,135
1
vote
Are there ways to detect plain dm-crypt encryption and what are the countermeasures against them?
No, there is no way to detect the existence of dm-crypt on a block device in most configurations. The only way to prove that it is encrypted is to supply the information required to decrypt it, ...
- 67.1k
1
vote
Are there ways to detect plain dm-crypt encryption and what are the countermeasures against them?
Terminology can get tricky. High Entropy Data such as encryption or random data is easily recognized via a number of common tests such as:
Chi Square Distribution
Arithmetic Mean
Monte Carlo Pi
...
- 8,193
1
vote
Accepted
is it possible to change luks2 --key-size from 512b to 256b without losing data?
This is not possible without re-encrypting all the data. AES-XTS uses a key that's twice the size of the AES key. So a 256-bit AES-XTS key uses 128-bit AES and a 512-bit AES-XTS key uses 256-bit AES....
- 9,622
1
vote
Accepted
Is there any added benefit to using a random keyfile of more than 512 bits?
Short answer: no
Long answer: For plain mode, the manual for cryptsetup states in the "Notes on Password Processing" section:
From a key file: It will be cropped to the size given by -s. ...
- 11
1
vote
How safe is dm-crypt/LUKS? Would TPM make me more secure in this case?
TPM will definitely add an extra layer of security to your laptop.
if you configure LUKS without TPM you either allow automated mounting or select the prompt option i.e., prompt you before decrypting ...
- 808
1
vote
dm-crypt/LUKS: one-time password
Better options are:
TPM unlocking,
FIDO2/U2F unlocking,
PKI card unlocking.
It can be all done by systemd-cryptenroll and the Arch wiki has detailed instructions on all. Just search on it.
I ...
- 111
1
vote
dm-crypt/LUKS: one-time password
Setting up a OTP is probably not something you can easily and securely do. There are other options to solve your problem -
LUKS supports up to 8 simultaneous passphrases. You can fairly easily set ...
- 651
1
vote
Accepted
Mapping of encrypted to decrypted blocks in LUKS
LUKS is built on dm-crypt. The format of LUKS is basically a header that precedes the encrypted data (the actual data being shifted by an "offset" (see man cryptsetup) to allow the header to be stored ...
- 321
1
vote
EFI: encrypt ESP
ESP cannot be encrypted because firmware (UEFI) itself needs ability to read it. (efi bootloaders are just ordinary files stored in esp).
- 159
Only top scored, non community-wiki answers of a minimum length are eligible