Re: [dm-crypt] yet another "lost my partition" message

[Arno Wagner <arno@wagner.name>]

On Sat, Apr 16, 2011 at 12:15:59AM +1000, Roscoe wrote:
> On Fri, Apr 15, 2011 at 11:52 PM, Cristian KLEIN <cristiklein@gmail.com> wrote:
> ...
> > A posteriori, I cannot help wonder why such pretious information isn't
> > kept redundantly. Surely LUKS could have stored the header in 10 random
> > sectors with an easy-to-grep "HERE I AM" banner. Wouldn't this allow
> > users to recover the master-key (and part of the file-system) without
> > compromising security?
> ...
> 
> It's supposed to be fragile and easily destroyed, this is by design.
> 
> I don't think we should bother with complicated safeguards for people
> doing silly things. That installer interface should be modified long,
> long, long before the on-disk format is.

Indeed. Sorry, but security is always a trade-off against
usability. The trade-off in LUKS is still sound.
 
> Accidently running cryptsetup luksFormat is unfortunate, as is running
> mkfs or dd on the wrong device. Good thing for backups.

It is rather unlikely to accidentally do this with cryptsetup
in interactive mode. It warns you and asks for an uppercase "YES".
This seems to be a serious bug n the Ubuntu installer, which
seems to use --batch-mode on cryptsetup and then do inadequate
(one may say "incompetent") checking and asking. It also
seems not to warn clear enough that this will kill the
existing LUKS partition instead of mounting it. Pretty
bad design. Doing bad things to your partitions and filesystems
should be hard not easy. Don't forget that if you do this
to a FAT filesystem you also lose all data. It is not that 
LUKS is special in that regard.

Arno
-- 
Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email: arno@wagner.name 
GnuPG:  ID: 1E25338F  FP: 0C30 5782 9D93 F785 E79C  0296 797F 6B50 1E25 338F
----
Cuddly UI's are the manifestation of wishful thinking. -- Dylan Evans

If it's in the news, don't worry about it.  The very definition of 
"news" is "something that hardly ever happens." -- Bruce Schneier