On Mon, Mar 14, 2011 at 04:54:55PM +0100, Maciej Pilichowski wrote: > On Sunday 13 March 2011 21:22:14 Milan Broz wrote: > > > "plain" mode means directly configured dmcrypt - no metadata > > on disk. In cryptsetup it is used in "create" command. > > Thank you very much for all explanation, I am not crypto guy, so I > need time to let this info sink in :-) Pity it is not included in > such detail in man. You can find some more info in the FAQ. Hmm. Maybe I should add an item "What is the difference between plain dm-crypt and LUKS mode?". Maybe later today or some time this week. One thing with plain mode is that it gives you some level of deniability. If you claim "I wiped that partition with data from /dev/urandom", it is basically impossible to disprove this for plain dm-crypt. However, this is worth less than it seems, as all the states that can compell you to give them crypto keys can also imprison you or worse on mere the suspicion that you have encrypted data. These states currently seem to be the UK, the US and various dictatorships. In most western countries you can use LUKS and just refuse to hand over the keys. Arno -- Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email: arno@xxxxxxxxxxx GnuPG: ID: 1E25338F FP: 0C30 5782 9D93 F785 E79C 0296 797F 6B50 1E25 338F ---- Cuddly UI's are the manifestation of wishful thinking. -- Dylan Evans If it's in the news, don't worry about it. The very definition of "news" is "something that hardly ever happens." -- Bruce Schneier _______________________________________________ dm-crypt mailing list dm-crypt@xxxxxxxx http://www.saout.de/mailman/listinfo/dm-crypt
