On Mon, Jan 28, 2013 at 06:46:53PM -0500, .. ink .. wrote: > [..] > > > but a function like this or any other > > mechanism of header-protection would be nice to see as standard for LUKS. > > Especially because the first keyslot is so likely to be corrupted by > > partition > > managers (should be aroud the offset of keyslot 0 where they start to dump > > their > > data?). > > > > > has there been any study to find out which ones of the keyslots is most > likely to get corrupted accidentally by various tools? I do not think there is enough data. And there is the additional problem that corruption in others than slot 0 will not be noticed by most users. You are welcome to search the mai,ing-list archives and generate a statistic, of course. > will adding keys from the last slot going backwards add some protection > from keys being inaccessible due to accidental header corruption by various > tools? I think most tools will kill the header. After that, damage to key-slots does not matter much, as the header carries the all-iportant salts. While it does happen occasionally that just a key-slot gets corrupted, it is rare. The keyslot-checker I wrote was not due to a dire need, but because I hacked together a version in Python that read the disk directly in a 2-3 hours, and then Milan (rightfully) asked me to do it right. Provided entertainment for me for a weekend and an opportunity to look at libcryptsetup. I think we may have seen someting like 5-6 cases altogether in the last few years. No idea how many people managed to kill their LUKS containers, but never reported it on the list. And anyways, disks do die, so data-backup is mandatory even for encrypted volumes. See the FAQ for some suggestions. Arno -- Arno Wagner, Dr. sc. techn., Dipl. Inform., Email: arno@xxxxxxxxxxx GnuPG: ID: CB5D9718 FP: 12D6 C03B 1B30 33BB 13CF B774 E35C 5FA1 CB5D 9718 ---- One of the painful things about our time is that those who feel certainty are stupid, and those with any imagination and understanding are filled with doubt and indecision. -- Bertrand Russell _______________________________________________ dm-crypt mailing list dm-crypt@xxxxxxxx http://www.saout.de/mailman/listinfo/dm-crypt
