From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.saout.de ([127.0.0.1]) by localhost (mail.saout.de [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hTOJ8zEX_1Ly for ; Sun, 22 Dec 2013 23:06:29 +0100 (CET) Received: from mail-ea0-x235.google.com (mail-ea0-x235.google.com [IPv6:2a00:1450:4013:c01::235]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by mail.saout.de (Postfix) with ESMTPS for ; Sun, 22 Dec 2013 23:06:28 +0100 (CET) Received: by mail-ea0-f181.google.com with SMTP id m10so2015035eaj.26 for ; Sun, 22 Dec 2013 14:06:28 -0800 (PST) Received: from [192.168.2.18] (56.157.broadband5.iol.cz. [88.100.157.56]) by mx.google.com with ESMTPSA id 44sm40037578eek.5.2013.12.22.14.06.26 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Sun, 22 Dec 2013 14:06:27 -0800 (PST) Message-ID: <52B76261.9080408@gmail.com> Date: Sun, 22 Dec 2013 23:06:25 +0100 From: Milan Broz MIME-Version: 1.0 References: In-Reply-To: Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit Subject: [dm-crypt] Fwd: Practical malleability attack against CBC-Encrypted LUKS partitions List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: dm-crypt Below is very nice example of another "Evil maid" type attacks, here directly applied to LUKS CBC disks. I think it clearly shows known rule: If you let your machine out of your sight, it is no longer your machine. What is important (and blog mentions it) "It has already been known for a long time that CBC does not prevent a malleability attack (targeted manipulation of encrypted data) given that the attacker can modify the ciphertext and knows the corresponding plaintext as well." There is no integrity protection in LUKS devices (even cannot be for transparent disk encryption because there is no additional space to store integrity checksum / authentization tag data). Modification (random or malicious) of ciphertext is simply not detectable on the LUKS/dmcrypt level. BTW blog doesn't mention that CBC is no longer default mode for cryptsetup and was replaced by XTS mode. Milan > > http://www.jakoblell.com/blog/2013/12/22/practical-malleability-attack-against-cbc-encrypted-luks-partitions/ > > I. Abstract > > The most popular full disk encryption solution for Linux is LUKS > (Linux Unified Key Setup), which provides an easy to use encryption > layer for block devices. By default, newly generated LUKS devices are > set up with 256-bit AES in CBC mode. Since there is no integrity > protection/checksum, it is obviously possible to destroy parts of > plaintext files by changing the corresponding ciphertext blocks. > Nevertheless many users expect the encryption to make sure that an > attacker can only change the plaintext to an unpredictable random > value. The CBC mode used by default in LUKS however allows some more > targeted manipulation of the plaintext file given that the attacker > knows the original plaintext. This article demonstrates how this can > be used to inject a full remote code execution backdoor into an > encrypted installation of Ubuntu 12.04 created by the alternate > installer (the default installer of Ubuntu 12.04 doesn’t allow setting > up full disk encryption). > ...