Re: [dm-crypt] Fwd: Practical malleability attack against CBC-Encrypted LUKS partitions

[Arno Wagner <arno@wagner.name>]

On Mon, Dec 23, 2013 at 00:07:24 CET, /dev/ph0b0s wrote:
> On 12/22, Milan Broz wrote:
> > Below is very nice example of another "Evil maid" type attacks,
> > here directly applied to LUKS CBC disks.
> > 
> > I think it clearly shows known rule:
> > If you let your machine out of your sight, it is no longer your machine.
> > 
> > What is important (and blog mentions it)
> > 
> > "It has already been known for a long time that CBC does not prevent
> > a malleability attack (targeted manipulation of encrypted data) given
> > that the attacker can modify the ciphertext and knows the corresponding
> > plaintext as well."
> 
> Even more important, in this particular case, is that this "practical
> malleability attack" isn't actually very practical at all:
> 
>     "In the following I assume that we already have access to the
>     original plaintext and the ciphertext of one file on the system and
>     that we want to do our manipulations in this file:"
> 
> There are a number of other assumptions and variables that must be "just right"
> in order for this attack to have even a remote chance of working, e.g.:
> 
>     "This code can be executed from a Live CD against the encrypted
>     partition of an Ubuntu 12.04 installation. The position of the
>     /bin/dash file needs to be adjusted by doing a reference
>     installation with the same disk layout on a sufficiently similar
>     hardware."

And there lies a pretty catastrophic risk: If anything goes wrong,
the target will know it has been attacked. In many scenarios this
will prevent the use of this attack. 

Arno

-- 
Arno Wagner,     Dr. sc. techn., Dipl. Inform.,    Email: arno@wagner.name
GnuPG: ID: CB5D9718  FP: 12D6 C03B 1B30 33BB 13CF  B774 E35C 5FA1 CB5D 9718
----
There are two ways of constructing a software design: One way is to make it
so simple that there are obviously no deficiencies, and the other way is to
make it so complicated that there are no obvious deficiencies. The first
method is far more difficult.  --Tony Hoare