Efficacy of xts over 1TB
Quoted 8 lines · Christoph Anton Mitterer
Quoted 3 lines · Milan Broz
Imagine that someone today has LUKS device of >2TB and data on it. Switch to full 64 bit "plain" IV will change IV for all sectors above 2TB limit. I think users prefer read data from there instead of random noise:-)
Are you really sure?! ;) ... would be a nice
/dev/randomalternative or so ^^
Quoted 6 lines
Quoted 4 lines
So question is if XTS is ok for such large drives - the 1TB mentioned limit elsewhere is possible misinterpretation (block size/device size confusion?).
(... real answer must come from an expert in cryptography based on proper analysis.)
So you guess the the 1TB limit could be actually a "don't have blocks larger than 1TB" limit?!
Actually, it is the "plain" implementation that causes a 2TB limit because of repeating IVs. XTS has a block size limit, at 2^20 bits, (I think) but it is a recommended limit. As 512 bytes we are well below that :-)
Quoted 6 lines
Quoted 4 lines
Anyway, distro maintainer can set default using configure switch already --with-luks1-mode=xts (see also other switches).
So if you want to switch default in Debian, no problem:-)
I seem to have rather bad luck in moving cryptsetup things at distro level... ;)
Well...
Arno
Signature · 7 lines
Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email: [email protected] GnuPG: ID: 1E25338F FP: 0C30 5782 9D93 F785 E79C 0296 797F 6B50 1E25 338F ---- Cuddly UI's are the manifestation of wishful thinking. -- Dylan Evans If it's in the news, don't worry about it. The very definition of "news" is "something that hardly ever happens." -- Bruce Schneier
Quoted 6 lines · Arno Wagner
Quoted 2 lines
So you guess the the 1TB limit could be actually a "don't have blocks larger than 1TB" limit?!
Actually, it is the "plain" implementation that causes a 2TB limit because of repeating IVs. XTS has a block size limit, at 2^20 bits, (I think) but it is a recommended limit. As 512 bytes we are well below that :-)
So you mean we have two limits?
1) The limit related to the IVs that we get from "plain" after 32bit 512 byte blocks, or that we would get from plain64 on a Zettabyte device.
2) Another limit, on the maximum block size (which was misconceived as a maximum filesystem size) that can be securely used which is that 1TB thingy?
However we should never hit that one too?!
Cheers,
Chris.
Quoted 8 lines · Christoph Anton Mitterer
Quoted 6 lines · Arno Wagner
Quoted 2 lines
So you guess the the 1TB limit could be actually a "don't have blocks larger than 1TB" limit?!
Actually, it is the "plain" implementation that causes a 2TB limit because of repeating IVs. XTS has a block size limit, at 2^20 bits, (I think) but it is a recommended limit. As 512 bytes we are well below that :-)
So you mean we have two limits?
Yes. One on the block number and one on the block size.
Quoted 2 lines
1) The limit related to the IVs that we get from "plain" after 32bit 512 byte blocks, or that we would get from plain64 on a Zettabyte device.
That is IV limit, i.e. the limit on the block numbers.
Quoted 4 lines
2) Another limit, on the maximum block size (which was misconceived as a maximum filesystem size) that can be securely used which is that 1TB thingy?
However we should never hit that one too?!
That is the size for the individual blocks encrypted. For dm-crypt/LUKS we use 512 byte blocks, but XTS can do much larger. However beyond a certain block size it security is suspected to degrade. I looked the limits up again, the hard limit is (2^128)-2 x 128 bit blocks. If I understand this correctly exceeding this limit breaks the cipher. Then there is the soft limit of 2^20 x 128 bit, i.e. 16MB block size. The block size should be kept below that and 512B is well below it.
I do not know of any 1TB limit.
Arno
Signature · 7 lines
Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email: [email protected] GnuPG: ID: 1E25338F FP: 0C30 5782 9D93 F785 E79C 0296 797F 6B50 1E25 338F ---- Cuddly UI's are the manifestation of wishful thinking. -- Dylan Evans If it's in the news, don't worry about it. The very definition of "news" is "something that hardly ever happens." -- Bruce Schneier
Well....
I've just read some sections of the Standard... D4 and D6... it rather seems that really the whole size (of the partition) is meant,... and not just the block size... although they speak of ranges > 100 TB
*confused now*
Cheers,
Chris.
Quoted 7 lines · Christoph Anton Mitterer
Well....
I've just read some sections of the Standard... D4 and D6... it rather seems that really the whole size (of the partition) is meant,... and not just the block size... although they speak of ranges > 100 TB
Quoted 5 lines
*confused now*
Cheers,
Chris.
I suspect that comes from only 2^128 possible cipher blocks and the birthday paradox which would give you the same cipher block twice when having around 2^64 blocks (modelled as random).
Arno
Signature · 7 lines
Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email: [email protected] GnuPG: ID: 1E25338F FP: 0C30 5782 9D93 F785 E79C 0296 797F 6B50 1E25 338F ---- Cuddly UI's are the manifestation of wishful thinking. -- Dylan Evans If it's in the news, don't worry about it. The very definition of "news" is "something that hardly ever happens." -- Bruce Schneier
Quoted 2 lines · Christoph Anton Mitterer
I've just read some sections of the Standard... D4 and D6... it rather seems that really the whole size (of the partition) is meant,... and not
No, no, no, hell, no. They don't mean a size of a partition, or a disk or whatever. They talk about an amount of data because they mean exactly
that: an amount of data encrypted using the same key.
If you set up dm-crypt with aes-xts-plain on a 500G partition, fill it up with data, remove everything and fill it up again with other data you *did* encrypt 1TB of data using the same key despite the fact that your partition might only be 500G.
Please feel free to re-proceed the exercise with a 250G partition.
Of course, your attacker has to be able to capture a snapshot after the first fill-up ... probably via some forensic magic - people who believe in encryption often tend to also still believe in Peter Gutmann :)
regards
Mario
Signature · 3 lines
If you think technology can solve your problems you don't understand
technology and you don't understand your problems.
-- Bruce SchneierQuoted 8 lines · Mario 'BitKoenig' Holbe
Quoted 2 lines · Christoph Anton Mitterer
I've just read some sections of the Standard... D4 and D6... it rather seems that really the whole size (of the partition) is meant,... and not
No, no, no, hell, no. They don't mean a size of a partition, or a disk or whatever. They talk about an amount of data because they mean exactly
that: an amount of data encrypted using the same key.
Quoted 8 lines
If you set up dm-crypt with aes-xts-plain on a 500G partition, fill it up with data, remove everything and fill it up again with other data you *did* encrypt 1TB of data using the same key despite the fact that your partition might only be 500G.
Please feel free to re-proceed the exercise with a 250G partition.Of course, your attacker has to be able to capture a snapshot after the first fill-up ...
And that is the real limit in practice. This is more relevant for, e.g., encrypting tape backups or other backups were a number of generations is kept. If I understand this correctly, the actual data exposure if you encrypt in the order of 2^(n/2) bits, with n your block lenght, is very small, namely two blocks. But I would need to check to be sure.
Quoted 2 lines
probably via some forensic magic - people who believe in encryption often tend to also still believe in Peter Gutmann :)
Here I highly recomment the Epilogue, were Gutmann puts that into perspective for modern drives: "...it's unlikely that anything can be recovered from any recent drive except perhaps a single level via basic error-cancelling techniques...". Also note that nobody claims to sucessfully have done that and all major data recovery outfits claim they cannot recover anything after a single overwerwrite with zeros on modern drives. Also note that tape is very different and Gutmann still applies there. (Original paper with
updates: http://www.cs.auckland.ac.nz/~pgut001/pubs/secure_del.html)
Quoted 6 lines
regards
MarioSignature · 3 lines
If you think technology can solve your problems you don't understand technology and you don't understand your problems. -- Bruce Schneier
Nice quote!
Arno
Signature · 7 lines
Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email: [email protected] GnuPG: ID: 1E25338F FP: 0C30 5782 9D93 F785 E79C 0296 797F 6B50 1E25 338F ---- Cuddly UI's are the manifestation of wishful thinking. -- Dylan Evans If it's in the news, don't worry about it. The very definition of "news" is "something that hardly ever happens." -- Bruce Schneier
Quoted 3 lines · Mario 'BitKoenig' Holbe
Of course, your attacker has to be able to capture a snapshot after the first fill-up ... probably via some forensic magic - people who believe in encryption often tend to also still believe in Peter Gutmann :)
No forensic magic is needed if you are eg. using a LUKS crypted iSCSI volume and the attacker is able to mirror you network traffic.
Cheers, Uwe
Quoted 9 lines · Uwe Menges
Quoted 3 lines · Mario 'BitKoenig' Holbe
Of course, your attacker has to be able to capture a snapshot after the first fill-up ... probably via some forensic magic - people who believe in encryption often tend to also still believe in Peter Gutmann :)
No forensic magic is needed if you are eg. using a LUKS crypted iSCSI volume and the attacker is able to mirror you network traffic.
Cheers, Uwe
Well, if the attacker mirrors your network traffic with iSCSI, encryption does not matter anymore for any change analysis.
But using such a set-up wpuld be pretty stupid anayways.... ;-)
Arno
Signature · 7 lines
Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email: [email protected] GnuPG: ID: 1E25338F FP: 0C30 5782 9D93 F785 E79C 0296 797F 6B50 1E25 338F ---- Cuddly UI's are the manifestation of wishful thinking. -- Dylan Evans If it's in the news, don't worry about it. The very definition of "news" is "something that hardly ever happens." -- Bruce Schneier
Quoted 3 lines · Arno Wagner
Well, if the attacker mirrors your network traffic with iSCSI, encryption does not matter anymore for any change analysis. But using such a set-up wpuld be pretty stupid anayways.... ;-)
Why? Do you have better ideas how to circumvent trusting your remote Backup Provider than encrypting everything before sending it away?
Encrypted block-devices via iSCSI, AoE, or NBD are some of the more comfortable solutions I'm thinking about when it comes to efficient remote multi-generation backups (using rsnapshot on top, for example).
regards
Mario
Signature · 2 lines
Why did the tachyon cross the road? Because it was on the other side.
Quoted 11 lines · Mario 'BitKoenig' Holbe
Quoted 3 lines · Arno Wagner
Well, if the attacker mirrors your network traffic with iSCSI, encryption does not matter anymore for any change analysis. But using such a set-up wpuld be pretty stupid anayways.... ;-)
Why? Do you have better ideas how to circumvent trusting your remote Backup Provider than encrypting everything before sending it away?
Encrypted block-devices via iSCSI, AoE, or NBD are some of the more comfortable solutions I'm thinking about when it comes to efficient remote multi-generation backups (using rsnapshot on top, for example).
I should have said "...pretty stupid anyways, if you are worried about a change analysis attack.".
Arno
Signature · 7 lines
Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email: [email protected] GnuPG: ID: 1E25338F FP: 0C30 5782 9D93 F785 E79C 0296 797F 6B50 1E25 338F ---- Cuddly UI's are the manifestation of wishful thinking. -- Dylan Evans If it's in the news, don't worry about it. The very definition of "news" is "something that hardly ever happens." -- Bruce Schneier
En réponse à Arno Wagner <[email protected]> :
Quoted 3 lines
Well, if the attacker mirrors your network traffic with iSCSI, encryption does not matter anymore for any change analysis.
I don't know if it is the right place to ask, but do you have any links with this "change analysis" thing ?
Thanks
I.Octane
Quoted 2 lines
_______________________________________________
Envoyé avec Inmano, ma messagerie renversante et gratuite : http://www.inmano.com
Quoted 6 lines · octane indice
En r?ponse ? Arno Wagner <[email protected]> :
Quoted 3 lines
Well, if the attacker mirrors your network traffic with iSCSI, encryption does not matter anymore for any change analysis.
I don't know if it is the right place to ask, but do you have any links with this "change analysis" thing ?
Not really. What it does is expose on sector level (xts, EME) what parts of the filesystem are changed. The idea is that this can form a distinctice pattern, for example "Netscape is launching", "An email was received in mbox format" or "A Skype connection was initiated". In some contexts, this type of information leakage can be a risk.
Typically this is only a risk in a SigInt context, were people have long ago given up reading content (because it is too much effort with encryption or even infeasible), but look at traffic patterns. For example, it seems you can pretty clearly see from the pattern whether a military attack is imminent.
This is advanced IT Security vodoo and not really relevant for most users. The one context I can think of were it becomes relevant is if a specific application intentionally cause some kind of pattern to either signal it has been started or to actually leak information. For example a corrupted encryption program couls signal key-bits to the world in this fashion. Note that this is not really relevant for anything that has net access, as there bits are far easier to leak or directly send to the attacker. For most typical usage it is not a relevant threat.
If you have questions, I will be happy to elaborate more.
Arno
Signature · 7 lines
Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email: [email protected] GnuPG: ID: 1E25338F FP: 0C30 5782 9D93 F785 E79C 0296 797F 6B50 1E25 338F ---- Cuddly UI's are the manifestation of wishful thinking. -- Dylan Evans If it's in the news, don't worry about it. The very definition of "news" is "something that hardly ever happens." -- Bruce Schneier
Hi.
But this goes IMO more in the plausible denyability direction, doesn't it?
An attacker would still be not able to read what was written. And for most applications it should be extremely difficult or even impossible to make any conclusions,.. because of fragmentation... etc. pp.
Another issue is of course when you have corrupted programs in the system.... but then you're screwed anyway,... and there are usually much easier to implement hidden channels.... (but this argument shouldn't count as I always say myself ;) ).
Cheers,
Chris.
Quoted 5 lines · Christoph Anton Mitterer
Hi.
But this goes IMO more in the plausible denyability direction, doesn't it?
I think not even that. The attacker already know you likely have encrypted data or a lot of randomness. But then you have been changing that in a typical pattern for filesystem access.
The data leakage is real, but very, very low in volume and will not matter in almost all situations IMO, and therefore nobody will bother attacking that. Now if you store and process highly sensitive data in the exabyte-range, it might be a minor concern (an attacker could plant a document and later detect ot has been added to the encrypted device), but even there effort is extreme.
This is an example of an academic attack. Interesting, and show a real limit of the employed encryption method, but irrelevant for the real world.
Quoted 4 lines
An attacker would still be not able to read what was written. And for most applications it should be extremely difficult or even impossible to make any conclusions,.. because of fragmentation... etc. pp.
I agree.
Quoted 4 lines
Another issue is of course when you have corrupted programs in the system.... but then you're screwed anyway,... and there are usually much easier to implement hidden channels.... (but this argument shouldn't count as I always say myself ;) ).
Indeed. Just use a sequence of secors, and change or not them in a pattern.
Arno
Signature · 7 lines
Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email: [email protected] GnuPG: ID: 1E25338F FP: 0C30 5782 9D93 F785 E79C 0296 797F 6B50 1E25 338F ---- Cuddly UI's are the manifestation of wishful thinking. -- Dylan Evans If it's in the news, don't worry about it. The very definition of "news" is "something that hardly ever happens." -- Bruce Schneier
Quoted 1 line · Arno Wagner
data in the exabyte-range
Uhm... guess the only guys which have secret data in that range find it recently published at wikileaks anyway... ;) *HawHaw* Perhaps we should CC the US DoD in this thread.... ^^
Cheers,
Chris.