From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.saout.de ([127.0.0.1]) by localhost (mail.saout.de [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0vBOLuPYiCEq for ; Sun, 10 Mar 2013 20:23:18 +0100 (CET) Received: from v4.tansi.org (ns.km33513-03.keymachine.de [87.118.94.3]) by mail.saout.de (Postfix) with ESMTP for ; Sun, 10 Mar 2013 20:23:18 +0100 (CET) Received: from gatewagner.dyndns.org (84-74-164-49.dclient.hispeed.ch [84.74.164.49]) by v4.tansi.org (Postfix) with ESMTPA id E282C1404001 for ; Sun, 10 Mar 2013 20:23:17 +0100 (CET) Date: Sun, 10 Mar 2013 20:23:12 +0100 From: Arno Wagner Message-ID: <20130310192312.GA9676@tansi.org> References: <40727.130.226.154.66.1362921572.squirrel@lavabit.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <40727.130.226.154.66.1362921572.squirrel@lavabit.com> Subject: Re: [dm-crypt] Securely erase LUKS header List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: dm-crypt@saout.de On Sun, Mar 10, 2013 at 09:19:32AM -0400, hephey@lavabit.com wrote: > I'm having trouble calculating the amount of data I need to erase in the > header. > > The af-stripes appears to be hardcoded to 4000, according to the > specification [1]. > > First I made an encrypted loop-device, using default options: > > cryptsetup luksFormat /dev/loop0 > > I then made a header backup, using > > cryptsetup luksHeaderBackup --header-backup-file /tmp/header.img /dev/loop0 > > The size of this backup (/tmp/header.img) is exactly 1.052.672 bytes, > which fits with the number given in the FAQ (see 5.4) [2]. I'm asumming > that cryptsetup's calculation is correct. > > In the FAQ it's also stated that to wipe the header, I need to use to > formula: > > header size = (keyslots x stripes x keysize) + offset bytes In 5.4, I state just to wipe the first 10MB to be safe. Do I have the formula above anywthere as explicitely recommended for wipes? Is so, plese tell me where, so I can fix it. Arno -- Arno Wagner, Dr. sc. techn., Dipl. Inform., Email: arno@wagner.name GnuPG: ID: CB5D9718 FP: 12D6 C03B 1B30 33BB 13CF B774 E35C 5FA1 CB5D 9718 ---- One of the painful things about our time is that those who feel certainty are stupid, and those with any imagination and understanding are filled with doubt and indecision. -- Bertrand Russell