Re: [dm-crypt] FAQ Montly pointer 12/2012

[Arno Wagner <arno@wagner.name>]

On Fri, Dec 07, 2012 at 08:29:09PM +0100, Javier Juan Martínez Cabezón wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> On 06/12/12 16:29, Arno Wagner wrote:
> > Updates: Added a passphrase strength estimate based on 
> > http://it.slashdot.org/story/12/12/05/0623215/new-25-gpu-monster-devours-strong-passwords-in-minutes
> >
> >  Executive summary: It may be time to increase passphrase length.
> > 
> > -----
> > 
> > The FAQ can be found at -
> > http://code.google.com/p/cryptsetup/wiki/FrequentlyAskedQuestions 
> > and - in the sources as FAQ in the top-level directory.
> > 
> 
> 
> 
> This is applicable if the algoritm used to cipher is unknown as happen
> in plain dmcrypt?

It depends. In plain dm-crypt, determining whether you have
guessed the password is tricky anyways. Testing for different
ciphers would add some overhead and maybe give you something 
like 5-6 bits of security in addition.

> 
> Arno, is really useful/secure to get the ciphering algoritm in the
> LUKS header?

Yes, very much so. For LUKS, you do trial decryption of a keyslot,
and that is enough to tell you whether you have a good password.
My intuition is that the iterated hashing takes a lot longer than
the trial decryption, so trying different ciphers does not
add significant overhead. And there are not that many possible
ciphers anyways. Now, if you decide to not store the cipher,
then normal decryption would also need to try them and the
time would need to be taken into account in the maximum delay
a user is faced with. Better to increase the hash iteration 
count instead. 

Bottom line: An unknown hash or cipher algorithm does not add
much, unless it is homebrew. But in that case, it is still
accessible via the kernel and glaringly obvious. Besides, 
homebrew ciphers are often insecure.

Arno
-- 
Arno Wagner,     Dr. sc. techn., Dipl. Inform.,    Email: arno@wagner.name
GnuPG: ID: CB5D9718  FP: 12D6 C03B 1B30 33BB 13CF  B774 E35C 5FA1 CB5D 9718
----
One of the painful things about our time is that those who feel certainty
are stupid, and those with any imagination and understanding are filled
with doubt and indecision. -- Bertrand Russell