Date: Wed, 31 Dec 2014 08:26:39 +0100
From: Arno Wagner <arno@wagner.name>
Message-ID: <20141231072639.GA304@tansi.org>
References: <549E63FE.8020602@gmx.net> <20141227101133.GA21707@tansi.org>
 <54A1A63D.5060604@gmx.net> <54A1AB87.1070804@yahoo.com>
 <54A20EDA.9030400@gmx.net> <20141230100413.GA11208@tansi.org>
 <54A2EC7E.7030201@gmx.net>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <54A2EC7E.7030201@gmx.net>
Subject: Re: [dm-crypt] Asustor NAS and cryptsetup 1.6.1
To: dm-crypt@saout.de

ecryptfs leaks a lot of data like filenames, sizes, modifiaction 
times, etc. These can be critical. For example, sometimes 
file-sizes are misused as "fingerprints".
 
I would say definitely backwards security-wise, for possibly
some better usability.

Arno

On Tue, Dec 30, 2014 at 19:18:38 CET, msalists@gmx.net wrote:
> They are reluctant to give out any details, but are saying that they
> will be releasing a new version of their software in the coming
> weeks that uses ecryptfs instead.
> Is this a step forward or backward (or rather just "sideways")?
> 
> Mark
> 
> On 2014-12-30 02:04, Arno Wagner wrote:
> >On Tue, Dec 30, 2014 at 03:32:58 CET, msalists@gmx.net wrote:
> >>On 2014-12-29 11:29, Quentin Lefebvre wrote:
> >>>On 29/12/2014 20:06, msalists@gmx.net wrote :
> >>>>Assuming I did create the container with aes-cbc-essiv:sha256; would
> >>>>cryptsetup automatically figure out the correct parameters when it is
> >>>>subsequently called without those parameters to mount the container?
> >>>>Or do non-default parameters at creation time require the same
> >>>>non-default parameters again for subsequent mounts?
> >>>As you may have understood, in plain mode, there is no header, so
> >>>no way for cryptsetup to guess the algorithm used. Thus, if it is
> >>>a non-default one, it must be specified also at mount time.
> >>>
> >>Hm, makes sense. Is there some kind of a config file that I could
> >>specify the parameters in, and that would be read prior to using the
> >>defaults - similar to how some parameters for mount can be specified
> >>in /etc/fstab ?
> >Only if the NAS-makers added one. cryptsetup does not have
> >a mechanism for this.
> >
> >Arno
> 
> _______________________________________________
> dm-crypt mailing list
> dm-crypt@saout.de
> http://www.saout.de/mailman/listinfo/dm-crypt

-- 
Arno Wagner,     Dr. sc. techn., Dipl. Inform.,    Email: arno@wagner.name
GnuPG: ID: CB5D9718  FP: 12D6 C03B 1B30 33BB 13CF  B774 E35C 5FA1 CB5D 9718
----
A good decision is based on knowledge and not on numbers. -- Plato

If it's in the news, don't worry about it.  The very definition of 
"news" is "something that hardly ever happens." -- Bruce Schneier