FAQ Montly pointer 12/2012
Updates: Added a passphrase strength estimate based on
http://it.slashdot.org/story/12/12/05/0623215/new-25-gpu-monster-devours-strong-passwords-in-minutes
Executive summary: It may be time to increase passphrase length.
-----
The FAQ can be found at
- http://code.google.com/p/cryptsetup/wiki/FrequentlyAskedQuestions
and
- in the sources as FAQ in the top-level directory.
Signature · 6 lines
Arno Wagner, Dr. sc. techn., Dipl. Inform., Email: [email protected] GnuPG: ID: CB5D9718 FP: 12D6 C03B 1B30 33BB 13CF B774 E35C 5FA1 CB5D 9718 ---- One of the painful things about our time is that those who feel certainty are stupid, and those with any imagination and understanding are filled with doubt and indecision. -- Bertrand Russell
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Quoted 11 lines · Arno Wagner
Updates: Added a passphrase strength estimate based on
http://it.slashdot.org/story/12/12/05/0623215/new-25-gpu-monster-devours-strong-passwords-in-minutesExecutive summary: It may be time to increase passphrase length.
-----
The FAQ can be found at -
http://code.google.com/p/cryptsetup/wiki/FrequentlyAskedQuestions
and - in the sources as FAQ in the top-level directory.
This is applicable if the algoritm used to cipher is unknown as happen in plain dmcrypt?
Arno, is really useful/secure to get the ciphering algoritm in the LUKS header?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
iQIcBAEBAgAGBQJQwkODAAoJEFfmTgt/w77fw2UP/jdGU2TjX78JpJAn/xPG2zyz ypKRcqCSzd275Ssf5Q+c7D8pWx5g3Dd1bwJJuSBIgoSrZF6UP2mm/RJ0OrX7OTD6 xhHJEyhx4a+PxYj/fSNqdK165DrXrBExons7hloEPi7wKLMa9heESVkjEm0VNRE+ JjUOmDwAS7gHFw+/tDID4HI5Grson9Sa3QfcPD48ZeS+vdcGHW6ge++t4i8r+iXK 57XsN9bbKnIA2mx2J1FazxnE8f2TiA343xJs9cG2nuVsahlgqX29nwFbRA8wfoP9 aSSxN4tshaLEDDzVlzec2rYKCW+VAaPxixvMkpR50HiDbVRn3XnAB+I84RUG4zZ1 H1pi44ZT5qUpm2sexVJ0KgRvIfno/JUvjTMQ8tLkU1Si/i8o9uF7Kgpzfpy4lUY3 /YceOsyT0FHL17qmQoKRsVB2QLkxnb0YOI4D9NMi5rsB9R7/4N1kddVFyXji9812 jC27hEtDthQQymKEd11OBZipm1SL5OuFhIiYs/LHko/W2BFoTgVYpHf9nx5udpJ+ /MjGHcT0xOd6Wm+5OM4738wmDtkC3C0MpFKYKANVy22lvIHFlFEBfV1KBaEHTEpD AH13OVM9k6eUP20cE84heldlIkgsGwnLJegNxFNTdXQ4U6bqfzM5lgLjsmRXvAqr ROry+/hl+k13wE/ogtOY
=RCwp
-----END PGP SIGNATURE-----
Quoted 18 lines · Javier Juan Martínez Cabezón
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1Quoted 11 lines · Arno Wagner
Updates: Added a passphrase strength estimate based on
http://it.slashdot.org/story/12/12/05/0623215/new-25-gpu-monster-devours-strong-passwords-in-minutesExecutive summary: It may be time to increase passphrase length.
-----
The FAQ can be found at -
http://code.google.com/p/cryptsetup/wiki/FrequentlyAskedQuestions
and - in the sources as FAQ in the top-level directory.
Quoted 2 lines
This is applicable if the algoritm used to cipher is unknown as happen in plain dmcrypt?
It depends. In plain dm-crypt, determining whether you have guessed the password is tricky anyways. Testing for different ciphers would add some overhead and maybe give you something like 5-6 bits of security in addition.
Quoted 3 lines
Arno, is really useful/secure to get the ciphering algoritm in the LUKS header?
Yes, very much so. For LUKS, you do trial decryption of a keyslot, and that is enough to tell you whether you have a good password. My intuition is that the iterated hashing takes a lot longer than the trial decryption, so trying different ciphers does not add significant overhead. And there are not that many possible ciphers anyways. Now, if you decide to not store the cipher, then normal decryption would also need to try them and the time would need to be taken into account in the maximum delay a user is faced with. Better to increase the hash iteration count instead.
Bottom line: An unknown hash or cipher algorithm does not add much, unless it is homebrew. But in that case, it is still accessible via the kernel and glaringly obvious. Besides, homebrew ciphers are often insecure.
Arno
Signature · 6 lines
Arno Wagner, Dr. sc. techn., Dipl. Inform., Email: [email protected] GnuPG: ID: CB5D9718 FP: 12D6 C03B 1B30 33BB 13CF B774 E35C 5FA1 CB5D 9718 ---- One of the painful things about our time is that those who feel certainty are stupid, and those with any imagination and understanding are filled with doubt and indecision. -- Bertrand Russell