[dm-crypt] recover old crypt partition

[dm-crypt] recover old crypt partition

[Jan Christoph Uhde]

Hello,
i'd like to recover an old encrypted partition:

The following problems occur:

* Only a big part of the password is known
** It has 17 or 19 signs 13 are known and 1 sing is perpended and 3 
appended form a set of 5 candidates.

* The algorithem is unkown
** I guess it was the standard back in 2003 - 2005. I tried with the 
last point from the FAQ - no luck so far

* I had to switch my terminal from utf8 to iso-8859-15 when i mounted my 
disk the last times
** this is probably the biggest problem

I am glad about any advice or script that might help me. The disk is one 
of the last non-sata disks and i guess i should do it soon:)

best regards,
jan

Re: [dm-crypt] recover old crypt partition

[Arno Wagner]

On Thu, Jan 06, 2011 at 01:22:36PM +0100, Jan Christoph Uhde wrote:
> Hello,
> i'd like to recover an old encrypted partition:
>
> The following problems occur:
>
> * Only a big part of the password is known
> ** It has 17 or 19 signs 13 are known and 1 sing is perpended and 3  
> appended form a set of 5 candidates.

"sign"? Do you mean "character"? If so, 13 known, 6 unknown and
another 4 from 5 possibilities gives you 256^6 * 5^4  = 1.76*10^17
possibilities, which is a bit outside of what you can just try. 
Anything more known about the uunknowen ones?

> * The algorithem is unkown
> ** I guess it was the standard back in 2003 - 2005. I tried with the  
> last point from the FAQ - no luck so far

Is this plain dm-crypt?

> * I had to switch my terminal from utf8 to iso-8859-15 when i mounted my  
> disk the last times
> ** this is probably the biggest problem

That would surprise me. Seems rather trivial in comparison.

Well, I think this will require serious work and serious 
computation. 

Arno



> I am glad about any advice or script that might help me. The disk is one  
> of the last non-sata disks and i guess i should do it soon:)
>
> best regards,
> jan
> _______________________________________________
> dm-crypt mailing list
> dm-crypt@saout.de
> http://www.saout.de/mailman/listinfo/dm-crypt
>

-- 
Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email: arno@wagner.name 
GnuPG:  ID: 1E25338F  FP: 0C30 5782 9D93 F785 E79C  0296 797F 6B50 1E25 338F
----
Cuddly UI's are the manifestation of wishful thinking. -- Dylan Evans

If it's in the news, don't worry about it.  The very definition of 
"news" is "something that hardly ever happens." -- Bruce Schneier 

[dm-crypt] recover old crypt partition

[Jan Christoph Uhde]

 > "sign"? Do you mean "character"? If so, 13 known, 6 unknown and
 > another 4 from 5 possibilities gives you 256^6 * 5^4  = 1.76*10^17
 > possibilities, which is a bit outside of what you can just try.
 > Anything more known about the uunknowen ones?

the password is in the From:

UKKKKKKKKKKKKKUUU   where U in %,#,$,_,!,^

 > Is this plain dm-crypt?

i used cryptsetup in debian sid

PS: I did not receive a mail jet so please excuse that i am not replying 
i a proper way.

Jan

Re: [dm-crypt] recover old crypt partition

[Arno Wagner]

On Thu, Jan 06, 2011 at 04:33:52PM +0100, Jan Christoph Uhde wrote:
> > "sign"? Do you mean "character"? If so, 13 known, 6 unknown and
> > another 4 from 5 possibilities gives you 256^6 * 5^4  = 1.76*10^17
> > possibilities, which is a bit outside of what you can just try.
> > Anything more known about the uunknowen ones?
>
> the password is in the From:
>
> UKKKKKKKKKKKKKUUU   where U in %,#,$,_,!,^

Ah. And KK...KK is known? What are the other unknowns besides 
the Us? The Us give you 6^4 possibilities, which is about 
1300.

> > Is this plain dm-crypt?
>
> i used cryptsetup in debian sid

Yes, but did you create a LUKS partition or a plain dm-crypt one?
The default would have been dm-crypt. Hmm. That would mean the cipher 
is probably the old default of aes-cbc-plain. Can anybody confirm that
for Debian SID?

> PS: I did not receive a mail jet so please excuse that i am not replying  
> i a proper way.

You will not get one. This list is actually also for discussing
these questions. If you want to have a private discussion, you
can reach me at arno@wagner.name

Arno
-- 
Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email: arno@wagner.name 
GnuPG:  ID: 1E25338F  FP: 0C30 5782 9D93 F785 E79C  0296 797F 6B50 1E25 338F
----
Cuddly UI's are the manifestation of wishful thinking. -- Dylan Evans

If it's in the news, don't worry about it.  The very definition of 
"news" is "something that hardly ever happens." -- Bruce Schneier 

Re: [dm-crypt] recover old crypt partition

[Jonas Meurer]

[-- Attachment #1: Type: text/plain, Size: 907 bytes --]

Hey,

On 06/01/2011 Arno Wagner wrote:
> On Thu, Jan 06, 2011 at 04:33:52PM +0100, Jan Christoph Uhde wrote:
> > > Is this plain dm-crypt?
> >
> > i used cryptsetup in debian sid
> 
> Yes, but did you create a LUKS partition or a plain dm-crypt one?
> The default would have been dm-crypt. Hmm. That would mean the cipher 
> is probably the old default of aes-cbc-plain. Can anybody confirm that
> for Debian SID?

what do you mean with "the default". it highly depends on the method
that was used to encrpyt the device. was it done during installation
process (debian-installer), with the shipped luksformat script, with
some graphical frontend (gnome-device-manager, gnome-disk-utility, ...)
or by invoking cryptsetup directly (with which commandline arguments?).

the default cipher depends on the cryptsetup package version used when
the decive was encrypted.

greetings,
 jonas

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 836 bytes --]

Re: [dm-crypt] recover old crypt partition

[Arno Wagner]

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain; charset=unknown-8bit, Size: 2364 bytes --]

On Thu, Jan 06, 2011 at 10:08:42PM +0100, Jonas Meurer wrote:
> Hey,
> 
> On 06/01/2011 Arno Wagner wrote:
> > On Thu, Jan 06, 2011 at 04:33:52PM +0100, Jan Christoph Uhde wrote:
> > > > Is this plain dm-crypt?
> > >
> > > i used cryptsetup in debian sid
> > 
> > Yes, but did you create a LUKS partition or a plain dm-crypt one?
> > The default would have been dm-crypt. Hmm. That would mean the cipher 
> > is probably the old default of aes-cbc-plain. Can anybody confirm that
> > for Debian SID?
> 
> what do you mean with "the default". it highly depends on the method
> that was used to encrpyt the device. was it done during installation
> process (debian-installer), with the shipped luksformat script, with
> some graphical frontend (gnome-device-manager, gnome-disk-utility, ...)
> or by invoking cryptsetup directly (with which commandline arguments?).
> 
> the default cipher depends on the cryptsetup package version used when
> the decive was encrypted.

That is why I asked. And you are right, a commandline default
does not cut it, more information is needed. 

Well, at least whether it was LUKS or not is easily answered.
A look into a hexdump of the start of the device will show the
magic string "LUKS" right at the start. Options to get that:

-  hd /dev/<device> | head
-  hexdump /dev/<device> | head
-  hex /dev/<device> | head

and possibly a few others. Example from my LUKS test container
in a file:

R gatewagner:~/f/luks# hd luksfile | head
00000000  4c 55 4b 53 ba be 00 01  61 65 73 00 00 00 00 00  |LUKSº¾..aes.....|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  63 62 63 2d 65 73 73 69  |........cbc-essi|
00000030  76 3a 73 68 61 32 35 36  00 00 00 00 00 00 00 00  |v:sha256........|
00000040  00 00 00 00 00 00 00 00  73 68 61 31 00 00 00 00  |........sha1....|

If it looks completely random though, it is likely plain dm-crypt.

Arno
-- 
Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email: arno@wagner.name 
GnuPG:  ID: 1E25338F  FP: 0C30 5782 9D93 F785 E79C  0296 797F 6B50 1E25 338F
----
Cuddly UI's are the manifestation of wishful thinking. -- Dylan Evans

If it's in the news, don't worry about it.  The very definition of 
"news" is "something that hardly ever happens." -- Bruce Schneier 

Re: [dm-crypt] recover old crypt partition

[Jonas Meurer]

[-- Attachment #1: Type: text/plain, Size: 1872 bytes --]

Hey,

On 07/01/2011 Arno Wagner wrote:
> On Thu, Jan 06, 2011 at 10:08:42PM +0100, Jonas Meurer wrote:
> > Hey,
> > 
> > On 06/01/2011 Arno Wagner wrote:
> > > On Thu, Jan 06, 2011 at 04:33:52PM +0100, Jan Christoph Uhde wrote:
> > > > > Is this plain dm-crypt?
> > > >
> > > > i used cryptsetup in debian sid
> > > 
> > > Yes, but did you create a LUKS partition or a plain dm-crypt one?
> > > The default would have been dm-crypt. Hmm. That would mean the cipher 
> > > is probably the old default of aes-cbc-plain. Can anybody confirm that
> > > for Debian SID?
> > 
> > what do you mean with "the default". it highly depends on the method
> > that was used to encrpyt the device. was it done during installation
> > process (debian-installer), with the shipped luksformat script, with
> > some graphical frontend (gnome-device-manager, gnome-disk-utility, ...)
> > or by invoking cryptsetup directly (with which commandline arguments?).
> > 
> > the default cipher depends on the cryptsetup package version used when
> > the decive was encrypted.
> 
> That is why I asked. And you are right, a commandline default
> does not cut it, more information is needed. 
> 
> Well, at least whether it was LUKS or not is easily answered.
> A look into a hexdump of the start of the device will show the
> magic string "LUKS" right at the start. Options to get that:
> 
> -  hd /dev/<device> | head
> -  hexdump /dev/<device> | head
> -  hex /dev/<device> | head
> 
> and possibly a few others. Example from my LUKS test container
> in a file:

even better would be a luksDump: 'cryptsetup luksDump /dev/<device>'.

If the device is a luks device, you even get information about cipher,
hash, and key size. If it's not a luks device, it'll simply output:

Device /dev/vg_int/ctemp1 is not a valid LUKS device.

greetings,
 jonas

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 836 bytes --]