I'm with Chris. Make backups of the header if it concerns you. On Fri, Jun 4, 2010 at 4:05 PM, Panagiotis Malakoudis <malakudi@xxxxxxxxx> wrote: > A single bit flip can happen, especially in USB keys (I had the corruption > in such a key). It can also happen to disks, by faulty hardware controllers, > overclocked buses etc. The point here is that a single bit flip invalidates > all your data. A sector corruption in the partition table does indeed > invalidate your data, but it is really easy to reconstruct it. A corruption > in the raid superblock also invalidates your data, but this can also be > reconstructed (not really easy, but it can be done). But a corruption in the > LUKS header cannot be undone. Of course, everyone should backup critical > data, residing in encrypted disks or not, however, loosing all your data > just because you lost one sector of the storage device is something that > should be somehow not allowed to happen. For what it's worth if it is really a single bit flip, for an n-bit string you only have to try n possibilities. So you have 256*4000=1024000 possibilities to go through. Amazon will give us a EC2 VM with "20" compute units which is about 20x a reference 1.2GHz Opteron for $0.68/hour. I wouldn't be surprised if my current 1.4GHz Atom was slower, and it takes around 5 seconds to unlock a keyslot. So, we'll need around (5 * 1024000) / 20 / 3600 * 0.68 = $50 and an EC2 account to retrieve one of my keyslots :). > I can suggest two things. A second copy of the first part of the LUKS header > (not the keyslots), residing just after the keyslots. And parity information > to keyslot data, in order to avoid the corruption that you loose some bytes > or one sector. Seems we're undoing the work of the AF splitter. -- Roscoe _______________________________________________ dm-crypt mailing list dm-crypt@xxxxxxxx http://www.saout.de/mailman/listinfo/dm-crypt
