Comments (5)
In current LUKS on-disk header hash spec is common for all slots, in current
code
only "sha1" is supported.
I have already patch which allow use all hashes provided by gcrypt for AF
(specified
by -h during luksFormat).
The only problem is that in LUKS header is only 20 bytes (enough for sha1)
reserved
for MK digest - so only first 20 bytes of final hash can be compared.
The hash definition per slot - maybe in LUKS2, definitely not possible with
current
on-disk format.
But there will be soon possibility to "reformat" LUKS header with different
hash, but
retaining the same volume key - this is problably enough, I guess?
Original comment by [email protected]
on 20 Jul 2009 at 7:38
from cryptsetup.
Yes, I see that it isn't possible to have different hashs for key slots of the
same
device, but at least that could be regarded as wishlist item for LUKS2.
And for the particular bugreport in debian I guess that the submitter is happy
if he
can change the hash on the fly.
greetings,
jonas
Original comment by [email protected]
on 21 Jul 2009 at 10:15
from cryptsetup.
Devel code have now selection of hash for LUKS header, this fixes partially the
problem.
I'll update the bug when other parts of problem are adressed.
Original comment by [email protected]
on 30 Jul 2009 at 3:12
- Changed state: Started
from cryptsetup.
All the ways I can think to solve the problem mean doing the system not
backwards
compatible. Though I think this issue is obvious and unavoidable.
Anyway, if we want to keep a "backwards" compatible system for the rest of key
slots
(Those using the same function as the rootkey) we could use a special value for
the
active field and store the data in one of the anti-forensics" stripes.
The main problem is that I don't know how the active field is parsed and
processed as
the behaviour is undefined when the active field doen't contain 0x0000DEAD nor
0x00AC71FE :(
Original comment by [email protected]
on 5 Jan 2010 at 3:05
from cryptsetup.
gmazyland, Jul 20, 2009 said:
"The only problem is that in LUKS header is only 20 bytes (enough for sha1)
reserved for MK digest - so only first 20 bytes of final hash can be compared."
That's disappointing, but I suppose it's unavoidable to maintain backwards
compatibility. So, if I select --hash sha512 during luksFormat, am I to
understand that the sha512sum of the inflated master key is truncated to its
first 20 bytes and saved as the MK Digest? Is that right?
Will LUKS_DIGESTSIZE stay fixed at 20 bytes until LUKS2?
Original comment by [email protected]
on 11 Jul 2010 at 8:04
from cryptsetup.
Related Issues (20)
- enhancement: give crypttab option "user" so users can mount preconfigured encrypted devices as fstab has HOT 1
- luksSuspend should work without specifying detached header HOT 1
- The whrilpool cryptsetup FAQ entry should be updated to reflect that the issue happens too with libgcrypt 1.5.4 HOT 10
- dm-crypt 1.6.6 is unable to open partition with password stored in file HOT 8
- Ubuntu 12.04, 1.6.6 can NOT open truecrypt disc/partition/container. HOT 5
- luksDump prints unsigned fields as signed HOT 4
- Keep multiple copies of the headers/keyslots throughout the volume HOT 1
- Please add support for TrueCrypt using libtcplay HOT 4
- Support decryption in cryptsetup_reencrypt HOT 2
- Segfault due to use of non-portable strerror_r HOT 4
- cryptsetup-1.6.6 does not open LUKS ecb-mode partitions HOT 6
- veritysetup bug that depends on the size of the image HOT 2
- could not find fipscheck library HOT 3
- Please add TOTP support HOT 1
- Fails to open loop-AES if password is given at the prompt HOT 5
- keyfile-offset ignored (again?) HOT 3
- Typo in man HOT 1
- veracrypt support HOT 12
- Display password on screen HOT 4
- Fails to decrypt LUKS file on a samba server due to use of O_DIRECT flag HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from cryptsetup.