On Sun, Aug 08, 2010 at 05:57:26AM +0200, Arno Wagner wrote: > > Oh, certainly. I spent a long time on this before even looking into other > > possibilities. I put the disks on another machine to test, and tried with > > the passphrase in a keyfile, loaded with --key-file, with and without > > trailing cr/lf, as well as typing the passphrase in the clear and cut-n-pasting > > it into the cryptsetup prompt. > > Ok. Have you tried one of your backups for comparison as well? > They should work. Just for completeness... > > Incidentially, your backups should contain a good header + key-slots, > so copying them over should repair any possible damage. See > FAQ item on making header backups. But don't do that yet, compare > the first 1MiB+4096B of a backup and a life disk first. Any header > or key-slot corruption should show up as difference. If there is no > difference, then you have some other problem. The "real" backups are taken from the mounted filesystem, so they don't contain the LUKS key material. The mirror-copies I have were all made over a short period of time and display the same problem, suggesting that the damage happened some time before that and wasn't noticed until the reboot. > > for what it's worth, the partitions are identical at least for a few gigabytes > > in. Though I haven't compared the whole 900+ GB, I assume 3 or 4 GB should be > > more than enough to cover any possible key material. So whatever corruption > > has happened would seem to have been above the disk level. > > 1MiB+4096B is enough to cover header and all keyslots. Hmm. > > > here's a couple of questions - first, how do I determine the total extent > > of the partition in which corruption could cause this problem; i.e, header, > > all key material? > > Not a partition. Just the first 1MiB+4096B. They are not shown > in the decrypted device, the decrypted device is the sectors right > after that. Also documented in the FAQ. > > The problem could also happen, I think, if one of the salts > got corrupted. But I would need to try that to be sure. Apart > from that, the key-slots are the main suspect. > > > And second, is that area sparse, or should it all be > > filled in. > > Mostly key data, but the key-stripes do not quite fill the 128kiB > allocated for each. See FAQ. > > > I was thinking of looking through it manually trying to find > > patterns of data that might have been dropped on top of it from buffer cache > > or elsewhere, for instance readable text, raid or filesystem superblocks, > > magic numbers of common executable or other file types, etc. This could at > > least provide a clue. But if the area is sparse and might normally contain > > data that was already on the raw partition before it was luksFormatted, it > > would be more difficult. > > No, this is a good idea. But do the comparison with the header and > key-slots on a working backup disk first. See FAQ item > "What does the on-disk structure of LUKS look like?" > for exact length and position of the key-slots. A key-slot consists > of tighly packed (no spacer or unused space) anti-forensic stripes > and looks like encrypted data, i.e. "random". If you want to get a > feel for it, FAQ item "How do I use LUKS with a loop-device?" gives > instructions how to do LUKS on a file via the loop-device. This is interesting. Looking through the first 1MiB+4096B I see quite a lot of material that is obviously not key material - i.e, text, perl snippets, and other stuff one would ordinarily see lying around a linux system disk. Now, there was only ever a single LUKS keyslot in use, so if the space dedicated to to the rest of them does not get initialized, it could be that I am just seeing what was on the disk before LUKS was initialized. However, it could also be bits of other areas of the disk, or buffer cache, that got written to the keyslot areas. > > thanks very much for your help, btw. > > You are welcome. > > Sorry for pointing to the FAQ so often, it really gives you most > of the info you need. Current copy posted on this list today or > on the web at > > http://code.google.com/p/cryptsetup/wiki/FrequentlyAskedQuestions > The FAQ is very helpful; sorry I missed a few parts such as the size of the key area. :) Thanks, eric _______________________________________________ dm-crypt mailing list dm-crypt@xxxxxxxx http://www.saout.de/mailman/listinfo/dm-crypt
