On Sun, Jun 02, 2002 at 04:36:29PM +0300, Pavel Minev Penev wrote: > > 2) is there a way to find out if the given passwd is correct or not > > before trying to mount the fs and notice that mounting fails because of > > bad passwd? something like.... > > > > mount: wrong fs type, bad option, bad superblock on /dev/loop0, > > or too many mounted file systems > > I hope there isn't. And there shouldn't be -- the puprpose of > cryptography is to make your data accessable only to those who know the > password, if there was a way to tell if a password is invalid, there > would have been a way to brute force your encrypted partition > (a character in a password usually give about 5 bits of data, and thus > an 8-character password gives 5*8 = 40 bits which is breakable, and far > less secure than a 256-bit crypto key). H = hash function (sha256) You could store T1 = E_k1(H(k1)) And test that: T2 = D_k2(X) If T2 == H(k2), then there's a good (99.99999) chance that k1 == k2. WRT protecting from dictionary attacks, they will happen no matter that you do with a password based crypto deployment. THis beings me to another question...can loopAES or cryptoloo do password AND file based FS decryption? As in: k = key to filesystem image k = H(password || bytes_of_users_file). I have a USB keychain and would like this "something you have" and "something you know" security added to my "something you are" biometric laptop. JLC > > 3) is there a way to change the passwd? because for example if the user > > has the same passwd as the login passwd and now someone find out the > > passwd. what now???? is the only solution for this creating a new crypto > > file and copying all it's content from one to an other? > > I'm sure there is, but I don't know it. It can be done easily in loopAES since it has a userkey as well as a FSkey. FSkey = key to filesystem Ukey = user's key Ukey = H(password) FSkey = random key) FSkey is stored in FSimage as eFSkey eFSkey = E_Ukey(FSkey) So when you change 'password' you don't have to decrypto the whole FS and re-encrypt in with a new key. Does cryptoloop have this? JLC -- http://www.certainkey.com Suite 4560 CTTC 1125 Colonel By Dr. Ottawa ON, K1S 5B6 C: 613.263.2983 - Linux-crypto: cryptography in and on the Linux system Archive: http://mail.nl.linux.org/linux-crypto/
