Here is the first version. It is the same as at http://code.google.com/p/cryptsetup/wiki/FrequentlyAskedQuestions with the markup stripped and 80 column formatting. Arno ------------------------------------------------------------------ Sections 1. General Questions 2. Setup 3. Common Problems 4. Security Aspects 5. Backup and Data Recovery 6. Issues with Specific Versions of cryptsetup A. Contributors 1. General Questions * What is this? This is the FAQ (Frequently Asked Questions) for cryptsetup. It covers Linux disk encryption with plain dm-crypt (one passphrase, no management, no descriptor on disk) and LUKS (multiple user keys with one master key, anti-forensics, descriptor block at start of device, ...). The latest version should usually be available at http://code.google.com/p/cryptsetup/wiki/FrequentlyAskedQuestions * Who wrote this? Current FAQ maintainer is Arno Wagner <arno@xxxxxxxxxxx>. Wherever contributions are from other people, their name should be included in brackets with the respective article. If you want to contribute, send your article, including a descriptive headline, to the maintainer, or the dm-crypt mailing list with something like "FAQ ..." in the subject. Please note that by contributing to this FAQ, you accept the license described below. This work is under the "Attribution-Share Alike 3.0 Unported" license, which means distribution is unlimited, you may create derived works, but attributions to original authors and this license statement must be retained and the derived work must be under the same license. See http://creativecommons.org/licenses/by-sa/3.0/ for more details of the license. Side note: I did text license research some time ago and I think this license is best suited for the purpose at hand and creates the least problems. 2. Setup * How do I use LUKS with a loop-device? Just the same as with any block device. If you want, for example, use a 100MB file as LUKS container, do something like this: head -c 100M /dev/zero luksfile # create empty file losetup /dev/loop0 luksfile # map luksfile to /dev/loop0 cryptsetup luksFormat /dev/loop0 # create LUKS on the loop device Afterwards just use /dev/loop0 as a you would use a LUKS partition. To unmap the file when done, use "losetup -d /dev/loop0". 3. Common Problems * When I call cryptsetup from cron/CGI, I get errors about unknown features? If you get errors about unknown parameters or the like that are not present when cryptsetup is called from the shell, make sure you have no older version of cryptsetup on your system that then gets called by cron/CGI.For example some distributions install cryptsetup into /usr/sbin, while a manual install could go to /usr/local/sbin. As a debugging aid, call "cryptsetup --version" from cron/CGI or the non-shell mechanism to be sure you have the right version. 4. Security Aspects * How do I securely erase a LUKS partition? If you are in a desperate hurry, overwrite the first few kilobytes of the LUKS partition. This erases the salts and makes access impossible. However a LUKS header backup or full backup will still grant access to most or all data. To do this right, overwrite the whole LUKS partition with a single pass of zeros. This is enough for current HDDs. For SDDs you may want to erase the whole drive several times to be sure data is not retained by wear leveling. This is possibly insecure as SDD technology is not fully understood in this regard. Still, due to the anti-forensic properties of the LUKS key-slots, a single overwrite of an SSD could be enough. If in doubt, use physical destruction in addition. Keep in mind to also erase all backups. Example for a zero-overwrite erase of partition sda10 done with dd_rescue: dd_rescue -w /dev/zero /dev/sda10 * How do I securely erase a backup of a LUKS partition or header? That depends on the medium it is stored on. For HDD and SDD, use overwrite with zeros. For an SDD, you may want to overwrite the complete SDD several times and use physical destruction in addition, see last item. Treat USB flash drives the same as SDDs. For re-writable CD/DVD, a single overwrite should also be enough, due to the anti-forensic properties of the LUKS keyslots. For write-once media, use physical destruction. For low security requirements, just cut the CD/DVD into several parts. For high security needs, shred or burn the medium. If your backup is on magnetic tape, I advise physical destruction by shredding or burning. The problem with magnetic tape is that it has a higher dynamic range than HDDs and older data may well be recoverable after overwrites. Also write-head alignment issues can lead to data not actually being deleted at all during overwrites. 5. Backup and Data Recovery * What happens if I overwrite the start of a LUKS partition? * What happens if I damage the LUKS header or key-slots? There are two critical components for decryption: The salt values in the header itself and the key-slots. If the salt values are overwritten or changed, nothing (in the cryptographically strong sense) can be done to access the data, unless there is a backup of the LUKS header. If a key-slot is damaged, the data can still be read with a different keys-lot, if one is in use. * What does the on-disk structure of dm-crypt look like? There is none. dm-crypt takes a block device and gives encrypted access to each of its blocks with a key derived from the passphrase given. If you use a cipher different than the default, you have to specify that as a parameter to cryptsetup too. If you want to change the password, you basically have to create a second encrypted device with the new passphrase and copy your data over. On the plus side, if you accidentally overwrite any part of a dm-crypt device, the damage will be limited to the are you overwrote. * What does the on-disk structure of LUKS look like? A LUKS partition consists of a header, followed by 8 key-slot descriptors, followed by 8 key slots, followed by the encrypted data area. Header and key-slot descriptors fill the first 592 bytes. The key-slot size depends on the creation parameters, namely on the number of anti-forensic stripes and on key block alignment. With 4000 stripes (the default), each key-slot is a bit less than 128kB in size. Due to sector alignment of the key-slot start, that means the key block 0 is at offset 0x1000-0x20400, key block 1 at offset 0x21000-0x40400, and key block 7 at offset 0xc1000-0xe0400. The space to the next full sector address is padded with zeros. Never used key-slots are filled with what the disk originally contained there, a key-slot removed with "luksRemoveKey" or "luksKillSlot" gets filled with 0xff. Start of bulk data (with the default 4000 stripes and 8 key-slots) is at 0x101000, i.e. at 1'052'672 bytes, i.e. at 1MiB + 4096 bytes from the start of the partition. This is also the value given by command "luksDump" with "Payload offset: 2056", just multiply by the sector size (512 bytes). Incidentally, "luksHeaderBackup" dumps exactly the first 1'052'672 bytes to file and "luksHeaderRestore" restores them. The exact specification of the format is here: http://code.google.com/p/cryptsetup/wiki/Specification * How do I backup a LUKS header? While you could just copy the appropriate number of bytes from the start of the LUKS partition, the best way is to use command option "luksHeaderBackup" of cryptsetup. This protects also against errors when non-standard parameters have been used in LUKS partition creation. Example: cryptsetup luksHeaderBackup --header-backup-file h_bak /dev/mapper/c1 * How do I backup a LUKS partition? You do a sector-image of the whole partition. This will contain the LUKS header, the keys-slots and the data ares. It can be done under Linux e.g. with dd_rescue (for a direct image copy) and with "cat" or "dd". Example: cat /dev/sda10 > sda10.img dd_rescue /dev/sda10 sda10.img You can also use any other backup software that is capable of making a sector image of a partition. Note that compression is ineffective for encrypted data, hence it does not sense to use it. * Do I need a backup of the full partition? Would the header and key-slots not be enough? Backup protects you against two things: Disk loss or corruption and user error. By far the most questions on the dm-crypt mailing list about how to recover a damaged LUKS partition are related to user error. For example, if you create a new filesystem on a LUKS partition, chances are good that all data is lost permanently. For this case, a header+key-slot backup would often be enough. But keep in mind that a HDD has roughly a failure risk of 5% per year. It is highly advisable to have a complete backup to protect against this case. * Are there security risks from a backup of the LUKS header or a whole LUKS partition? Yes. One risk is that if you remove access rights for specific key-slots by deleting their contents, the data can still be accessed with invalidated passphrase and the backup. The other risk is that if you erase a LUKS partition, a backup could still grant access, especially if you only erased the LUKS header and not the whole partition. * I think this is overly complicated. Is there an alternative? Yes, you can use plain dm-crypt. It does not allow multiple passphrases, but on the plus side, it has zero on disk description and if you overwrite some part of a plain dm-crypt partition, exactly the overwritten parts are lost (rounded up to sector borders). 6. Issues with Specific Versions of cryptsetup A. Contributors In no particular order: * Arno Wagner ------------------------------------------------------------------ -- Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email: arno@xxxxxxxxxxx GnuPG: ID: 1E25338F FP: 0C30 5782 9D93 F785 E79C 0296 797F 6B50 1E25 338F ---- Cuddly UI's are the manifestation of wishful thinking. -- Dylan Evans If it's in the news, don't worry about it. The very definition of "news" is "something that hardly ever happens." -- Bruce Schneier _______________________________________________ dm-crypt mailing list dm-crypt@xxxxxxxx http://www.saout.de/mailman/listinfo/dm-crypt
