Greetings. I have a few questions about the use of cryptsetup and its security. First I'd like to know something about the command line options. I've seen people specify the digest (hash) in two different places in cryptsetup. Consider the following line: # cryptsetup -c aes-xts-plain64:sha512 -h sha512 -s 512 -y -i 5000 --use-random -y -v luksFormat /dev/sda1 What is the difference between specifying the hash in the -c parameter i.e. aes-xts-plain64:sha512 or by using the -h parameter? Do they both do the same thing meaning that the following two are equivalent? # cryptsetup -c aes-xts-plain64:sha512 -s 512 -y -i 5000 --use-random -y -v luksFormat /dev/sda1 # cryptsetup -c aes-xts-plain64 -h sha512 -s 512 -y -i 5000 --use-random -y -v luksFormat /dev/sda1 Next I'd like to ask about the memory management of the master key. Suppose I mounted a volume using luksOpen (or --type luks open). What happens when I invoke luksClose (close) on that container? Does the master key get securely erased from memory (several overwrites with random data) or is it simply blanked out (single overwrite with zeros)? How is the master key stored in memory? I read somewhere that having the same data in the exact same location in RAM for an extended period of time (like a 24/7 server) can "burn in" the data into the RAM module, which can be later recovered. Is this of any concern with current cryptsetup i.e. for attacks like cold boot? Finally I'm interested to know about removing all the keyslots. Suppose I mounted a container and erased every available keyslot (please don't ask why). I know this would in theory make the data irrecoverble, but the container is still mounted for the time being. Assuming that the power doesn't disappear, is there a way to reintroduce a new key slot into the LUKS container after all slots have been erased, provided that the container is mounted and I can read the master key from memory? Best regards! _______________________________________________ dm-crypt mailing list dm-crypt@xxxxxxxx http://www.saout.de/mailman/listinfo/dm-crypt
