Re: [dm-crypt] pashphrase management question

[Robert Nichols <rnicholsNOSPAM@comcast.net>]

On 10/26/2016 11:43 AM, ClEmFoster wrote:
> hello,
>
> The setup:
>
> I work in an environment that has a whole disk encryption requirement for
> VMs.  If the VM is restarted an admin has to hit the console and type in
> the passphrase to boot.  This is OK, we don't reboot much, and security
> guys are happy.  The problem is they are going to start requiring that
> these machines also receive a passphrase change every 3 or 6 months.  That
> brings me to the question.

Are "they" aware that anyone who has had read access to the device
with the LUKS container has had an opportunity to copy the LUKS
header, and can always use that LUKS header with the old passphrase
to unlock the container (perhaps after spending however much time
and processing power is needed to crack that passphrase offline).

For that matter, anyone with root access to the VM while the LUKS
container is unlocked can easily obtain the master key
(dmsetup table --showkeys /dev/{whatever}) and can always access
the LUKS container with that.

Changing the passphrase doesn't protect against any of that.

-- 
Bob Nichols     "NOSPAM" is really part of my email address.
                 Do NOT delete it.