On Tue, Apr 20, 2010 at 03:15:06PM +0100, Si St wrote: > To Arno: > > I tried first a regular LUKS partition as swap with passfrase. This of > course worked. I assume that ArnoWagners comment : "Allways /dev/random, > unless you have a low-entropy scenario" is for the general understanding > that urandom is not random but bound to predictable math calculation. Or > does ArnoWagner mean: opposed to a passphrase ? In the last instance it is > of course safer with /dev/random since nobody has read the output of that > blockfile except the machine(Rechner) itself. So far my understanding if > it is right. Both ;-) I mean that /dev/urandom is problematic in a low-entropy scenario and that passphrase should not be used for swap. Incidentially, it is a "passphrase". > To change from passfrase to dev_random I experienced that the partition > had to be zeroed with dd. Else it seemed like the LUKS-header was read and > asking for passfrase which did not work, and at the same time rejecting > the none-regular-file /dev/random with a message about that matter. This > of course is in consistency with the mechanism of LUKS-extension mentioned > under "DESCRIPTION" at a site like: > http://pwet.fr/man/linux/formats/crypttab Hmm. You do not need (or want) LUKS for swap. Plain dm-crypt is better. > But I could get hold of the swap by: > > cryptsetup -d /dev/random create _swap /dev/hdc11 > mkswap /dev/mapper/_swap > swapon -a That would be the way to do it. > But not with restart before or after this event just by > changing the files to: > > /etc/crypttab(1): > _swap /dev/hdc11 /dev/random swap,cipher=aes-cbc-essiv:sha256 > /etc/fstab: > dev/mapper/_swap swap swap defaults 0 0 I think I had this working with the following fstab line: /dev/mapper/_swap none swap sw 0 0 > But reediting the tab-files > /etc/crypttab(2): > _swap /dev/hdc11 none swap > > and restarting again the machine, I got hold of the swap-partition with > the previous passfrase like before, so mkswap probably do not overwrite > the 592 bytes luks-header and the AF splitted keys(?) Or is there another > explanation for this like with /dev/mapper_swap or that the swap had not > yet at that moment come into use, so I was just lucky? mkswap writes very little. However, cryptsetup -d /dev/random creates a plain dm-crypt device, no LUKS header involved. > QUESTION: > Would it suffice to erase the luks-magic with > dd if=/dev/zero of=/dev/hdc11 bs=1 count=6 > to make the crypttab and fstab work without zeroing out the partition first? It should work without that. > IN ALL: The swap after zeroing with dd on the partition in question works > with the crypttab(1) above, and as follows there ARE sufficient entropy > available to make up a key, so far. As to the config of fstab and crypttab > I followed the assignment from this site: > https://www.antagonism.org/privacy/encrypted-swap-linux.shtml > > QUESTION: But in case I would have to use a seed, how is this done? > Especially with an UPDATED seed? This I do not know. Advanced practical crypto implementation. What you do is, you store some entropy on system shutdown to use at the next start together with the best you can get at the start. On first start you are screwed, buut for swap it is less critical. For exaple done by GnuPG, in the form of $HOME/gnupg/random_seed. Arno -- Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email: arno@xxxxxxxxxxx GnuPG: ID: 1E25338F FP: 0C30 5782 9D93 F785 E79C 0296 797F 6B50 1E25 338F ---- Cuddly UI's are the manifestation of wishful thinking. -- Dylan Evans If it's in the news, don't worry about it. The very definition of "news" is "something that hardly ever happens." -- Bruce Schneier _______________________________________________ dm-crypt mailing list dm-crypt@xxxxxxxx http://www.saout.de/mailman/listinfo/dm-crypt
