Re: [dm-crypt] 1,5 TB partition: use cbc-essiv or xts-plain?

[theiling@absint.com (Henrik Theiling)]

Hi!

Moji writes a lot in interesting stuff and finally:
>...
> I hope this helps you,

This helped a lot, yes, thank you!


And Milan wrote:
> Just small note: dm-crypt (kernel part) have one key per mapped
> segment, you can create as many segments with different keys (even
> with different algorithms) (imagine simple Logical Volume in LVM
> split over several areas of disk - the same logic can be used for
> crypt segments.)

Interesting!

> Only userspace (cryptsetup) is not able to configure it easily - you have to use
> dmsetup directly (or stack LVM/MD over several LUKS devices).

:-(  But at least it's possible, I did not know that.


And Heinz wrote:
> The main weaknesses are often related to a bad passphrase or different
> circumstances which makes it easy for an adversary to get it, e.g.
> writing down the passphrase or choosing not enough entropy.

Right.  I try to remember extremely long passphrases (people tend to
have strange looks on their faces when I type a hard disk passphrase),
but of course, I'm no computer. :-)

**Henrik