Re: [dm-crypt] [ANNOUNCE] cryptsetup 1.3.0-rc1 (test release candidate)

[Arno Wagner <arno@wagner.name>]

On Tue, Mar 15, 2011 at 12:11:47PM +0100, Milan Broz wrote:
> On 03/15/2011 02:02 AM, Arno Wagner wrote:
> > On Tue, Mar 15, 2011 at 12:45:59AM +0100, Rudolf Deilmann wrote:
> >> On Mon, 14 Mar 2011 23:10:37 +0100
> 
> >> On my machine, $x greater than 90 results in different internal keys
> >> for 'cat keyfile | cryptsetup ' and 'cryptsetup --key-file keyfile'. If
> >> the key-file is even large, I get at least an error message. Sample
> >> keyfile ( x=91 ) attached or at http://pastebin.com/PeLUZ5a4, if the
> >> mailing list removes attachements. 
> > 
> > Wups, buffer overflow or cutdown (with the later being a whole
> > lot better, but still a problem)?
> 
> There are no fixed buffers :)

Ah, very good! (Not that I really suspected this was an overflow ;-)
 
> Increasing LOOPAES_KEYFILE_MAXSIZE helps.
> (it is clearly visible in debug output - when reading from stdout, it
> reads 8125 bytes, but from keyfile it is limited to 8000).

But a cut-down. Hmm. I think this makes sense, even if it can break some
things. But it should give an error rather than proceed, see below.

> I will also limit LUKS keyfile in next version, mistake will cause problems
> (reading the whole device in locked memory -> OOPS or something like that).

Indeed. What you could do is have it default to error instead of
to cut-down and proceed. That would make more sense, since
cutting it is almost always not going to work. The only case
I can think of were cutting works if is your key comes from
/dev/(u)random for swap or the like.

> I guess max 8MB is enough? We have already limit on passphrase 
> from terminal to 512 bytes.

If it gives a descriptive error message when the length is 
exceded, it is less critical. Also, a commandline option
to increase/decrease the limit may be a good idea, but I
would see it as non-urgent.

Arno

 
> Fixed in svn already.
> 
> Milan
> _______________________________________________
> dm-crypt mailing list
> dm-crypt@saout.de
> http://www.saout.de/mailman/listinfo/dm-crypt
> 

-- 
Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email: arno@wagner.name 
GnuPG:  ID: 1E25338F  FP: 0C30 5782 9D93 F785 E79C  0296 797F 6B50 1E25 338F
----
Cuddly UI's are the manifestation of wishful thinking. -- Dylan Evans

If it's in the news, don't worry about it.  The very definition of 
"news" is "something that hardly ever happens." -- Bruce Schneier