On Tue, Mar 15, 2011 at 12:11:47PM +0100, Milan Broz wrote: > On 03/15/2011 02:02 AM, Arno Wagner wrote: > > On Tue, Mar 15, 2011 at 12:45:59AM +0100, Rudolf Deilmann wrote: > >> On Mon, 14 Mar 2011 23:10:37 +0100 > > >> On my machine, $x greater than 90 results in different internal keys > >> for 'cat keyfile | cryptsetup ' and 'cryptsetup --key-file keyfile'. If > >> the key-file is even large, I get at least an error message. Sample > >> keyfile ( x=91 ) attached or at http://pastebin.com/PeLUZ5a4, if the > >> mailing list removes attachements. > > > > Wups, buffer overflow or cutdown (with the later being a whole > > lot better, but still a problem)? > > There are no fixed buffers :) Ah, very good! (Not that I really suspected this was an overflow ;-) > Increasing LOOPAES_KEYFILE_MAXSIZE helps. > (it is clearly visible in debug output - when reading from stdout, it > reads 8125 bytes, but from keyfile it is limited to 8000). But a cut-down. Hmm. I think this makes sense, even if it can break some things. But it should give an error rather than proceed, see below. > I will also limit LUKS keyfile in next version, mistake will cause problems > (reading the whole device in locked memory -> OOPS or something like that). Indeed. What you could do is have it default to error instead of to cut-down and proceed. That would make more sense, since cutting it is almost always not going to work. The only case I can think of were cutting works if is your key comes from /dev/(u)random for swap or the like. > I guess max 8MB is enough? We have already limit on passphrase > from terminal to 512 bytes. If it gives a descriptive error message when the length is exceded, it is less critical. Also, a commandline option to increase/decrease the limit may be a good idea, but I would see it as non-urgent. Arno > Fixed in svn already. > > Milan > _______________________________________________ > dm-crypt mailing list > dm-crypt@xxxxxxxx > http://www.saout.de/mailman/listinfo/dm-crypt > -- Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email: arno@xxxxxxxxxxx GnuPG: ID: 1E25338F FP: 0C30 5782 9D93 F785 E79C 0296 797F 6B50 1E25 338F ---- Cuddly UI's are the manifestation of wishful thinking. -- Dylan Evans If it's in the news, don't worry about it. The very definition of "news" is "something that hardly ever happens." -- Bruce Schneier _______________________________________________ dm-crypt mailing list dm-crypt@xxxxxxxx http://www.saout.de/mailman/listinfo/dm-crypt
