From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <wagner@tansi.org>
Received: from mail.saout.de ([127.0.0.1])
 by localhost (mail.saout.de [127.0.0.1]) (amavisd-new, port 10024)
 with ESMTP id Qh-2sIBZMTIy for <dm-crypt@saout.de>;
 Fri, 29 Nov 2013 02:03:54 +0100 (CET)
Received: from v6.tansi.org (unknown [87.118.116.4])
 by mail.saout.de (Postfix) with ESMTP
 for <dm-crypt@saout.de>; Fri, 29 Nov 2013 02:03:54 +0100 (CET)
Received: from gatewagner.dyndns.org (77-57-44-24.dclient.hispeed.ch
 [77.57.44.24]) by v6.tansi.org (Postfix) with ESMTPA id 1F2CF20DC23B
 for <dm-crypt@saout.de>; Fri, 29 Nov 2013 02:03:54 +0100 (CET)
Date: Fri, 29 Nov 2013 02:03:53 +0100
From: Arno Wagner <arno@wagner.name>
Message-ID: <20131129010353.GA7043@tansi.org>
References: <4b257a0455c2ff44b6c488df576b9764@www.mighty.co.za>
 <CAMw1ynShpDpGVNWZGfHNkvApbiMadidiBkVStDsL9AUkbZ+B9w@mail.gmail.com>
 <CAMw1ynQw8aaujScH=U-u6eyBbQM3g4jjBpt0BXak7zS8aTH2BQ@mail.gmail.com>
 <20131129003251.GB6415@tansi.org>
 <83ed4c2099c81c3e6e55621ec989e5a8@www.mighty.co.za>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <83ed4c2099c81c3e6e55621ec989e5a8@www.mighty.co.za>
Subject: Re: [dm-crypt] Cascading two plain dm-crypt volumes
List-Id: <dm-crypt.saout.de>
List-Unsubscribe: <http://www.saout.de/mailman/options/dm-crypt>,
 <mailto:dm-crypt-request@saout.de?subject=unsubscribe>
List-Archive: <http://www.saout.de/pipermail/dm-crypt/>
List-Post: <mailto:dm-crypt@saout.de>
List-Help: <mailto:dm-crypt-request@saout.de?subject=help>
List-Subscribe: <http://www.saout.de/mailman/listinfo/dm-crypt>,
 <mailto:dm-crypt-request@saout.de?subject=subscribe>
To: dm-crypt@saout.de

On Fri, Nov 29, 2013 at 01:49:57 CET, anderson jackson wrote:
> On Fri, 29 Nov 2013 01:32:51 +0100 Arno Wagner <arno@wagner.name> wrote
> 
> > If I understood this right, it is plain(luks(data))
> 
> No actually I meant plain(plain(data)). Therefore you won't see the luks
> header when the attacker finds the correct pass but just random data.
> 

That is not really more secure than just plain with the two 
passphrases concatenated (as long as the entropy does not
exceed the key length). No reason to do this, except if you 
mistrust the ciphers and want to use two different ones.

Arno
-- 
Arno Wagner,     Dr. sc. techn., Dipl. Inform.,    Email: arno@wagner.name
GnuPG: ID: CB5D9718  FP: 12D6 C03B 1B30 33BB 13CF  B774 E35C 5FA1 CB5D 9718
----
There are two ways of constructing a software design: One way is to make it
so simple that there are obviously no deficiencies, and the other way is to
make it so complicated that there are no obvious deficiencies. The first
method is far more difficult.  --Tony Hoare