* Re: [dm-crypt] Encrypted partitions with sectors to zero?
@ 2013-10-24 7:33 Thomas Martin
2013-10-24 11:53 ` Arno Wagner
0 siblings, 1 reply; 4+ messages in thread
From: Thomas Martin @ 2013-10-24 7:33 UTC (permalink / raw)
To: dm-crypt
Hello Arno.
> Encryption does not overwrite your data. If you want that
> with LUKS or plain dm-crypt, ypu need to do the overwrite
> yyourself. Some tools, like TrueCrypt, offer you to do
> this optionally during installation.
>
> See also FAQ item 5.3.
My bad, this is actually obvious (I always used shred when I was
converting my old unsecured machines before encrypting them).
> Yes. See FAQ item 5.3. If you do it for an already created
> filesystem, you will not reach everything though, that is
> why the overwrite should be done after crypto-mapping, but
> before filesystem creation.
>
> Arno
Good point, I was looking to avoid insecurities by disabling TRIM but
I didn't understood that this insecurity was "by default" even
wwithout TRIM (as I didn't filled the LUKS container).
Thanks a lot Arno, this is a lot more understandable for me now.
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [dm-crypt] Encrypted partitions with sectors to zero?
2013-10-24 7:33 [dm-crypt] Encrypted partitions with sectors to zero? Thomas Martin
@ 2013-10-24 11:53 ` Arno Wagner
0 siblings, 0 replies; 4+ messages in thread
From: Arno Wagner @ 2013-10-24 11:53 UTC (permalink / raw)
To: dm-crypt
On Thu, Oct 24, 2013 at 09:33:47AM +0200, Thomas Martin wrote:
> Hello Arno.
>
> > Encryption does not overwrite your data. If you want that
> > with LUKS or plain dm-crypt, ypu need to do the overwrite
> > yyourself. Some tools, like TrueCrypt, offer you to do
> > this optionally during installation.
> >
> > See also FAQ item 5.3.
>
> My bad, this is actually obvious (I always used shred when I was
> converting my old unsecured machines before encrypting them).
>
>
> > Yes. See FAQ item 5.3. If you do it for an already created
> > filesystem, you will not reach everything though, that is
> > why the overwrite should be done after crypto-mapping, but
> > before filesystem creation.
> >
> > Arno
>
> Good point, I was looking to avoid insecurities by disabling TRIM but
> I didn't understood that this insecurity was "by default" even
> wwithout TRIM (as I didn't filled the LUKS container).
>
>
> Thanks a lot Arno, this is a lot more understandable for me now.
You are welcome. SSDs are still a security risk with regard
to some features, namely erasing old data, changing
passphrases and securely erasing a LUKS container, see FAQ
Item 5.19. If you understand these issues and accept the associated
risks, encryption on SSDs is still a lot more secure than no
encryption.
Arno
--
Arno Wagner, Dr. sc. techn., Dipl. Inform., Email: arno@wagner.name
GnuPG: ID: CB5D9718 FP: 12D6 C03B 1B30 33BB 13CF B774 E35C 5FA1 CB5D 9718
----
There are two ways of constructing a software design: One way is to make it
so simple that there are obviously no deficiencies, and the other way is to
make it so complicated that there are no obvious deficiencies. The first
method is far more difficult. --Tony Hoare
^ permalink raw reply [flat|nested] 4+ messages in thread
* [dm-crypt] Encrypted partitions with sectors to zero?
@ 2013-10-23 14:24 Thomas Martin
2013-10-23 18:04 ` Arno Wagner
0 siblings, 1 reply; 4+ messages in thread
From: Thomas Martin @ 2013-10-23 14:24 UTC (permalink / raw)
To: dm-crypt
Hi everyone.
I was trying to verify that discard (TRIM) was disabled on my system
(new fresh install on a SSD) when I found some weird things.
Indeed it seems I have many sectors to zero; example:
root@o9020:~# hdparm --read-sector 54003000 /dev/sda
/dev/sda:
reading sector 54003000: succeeded
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
...
0000 0000 0000 0000 0000 0000 0000 0000
According to me, only my /boot partition should have zero (as this is
the only one unencrypted):
root@o9020:~# parted /dev/sda "unit s print"
Model: ATA LITEONIT LCS-128 (scsi)
Disk /dev/sda: 250069680s
Sector size (logical/physical): 512B/512B
Partition Table: msdos
Number Start End Size Type File system Flags
1 2048s 1953791s 1951744s primary ext4 boot
2 1955838s 250068991s 248113154s extended
5 1955840s 250068991s 248113152s logical
root@o9020:~# lsblk /dev/sda -f
NAME FSTYPE LABEL MOUNTPOINT
sda
├─sda1 ext4 /boot
├─sda2
└─sda5 crypto_LUKS
└─sda5_crypt (dm-0) LVM2_member
├─VolumeGroup1-root (dm-1) ext4 /
├─VolumeGroup1-swap (dm-2) swap [SWAP]
├─VolumeGroup1-usr (dm-3) ext4 /usr
├─VolumeGroup1-tmp (dm-4) ext4 /tmp
├─VolumeGroup1-opt (dm-5) ext4 /opt
├─VolumeGroup1-var (dm-6) ext4 /var
├─VolumeGroup1-home (dm-7) ext4 /home
└─VolumeGroup1-backups (dm-8) ext4 /backups
root@o9020:~# dmsetup table
VolumeGroup1-home: 0 97648640 linear 254:0 83978240
VolumeGroup1-usr: 0 19529728 linear 254:0 25389056
VolumeGroup1-var: 0 19529728 linear 254:0 64448512
VolumeGroup1-swap: 0 15622144 linear 254:0 9766912
VolumeGroup1-root: 0 9764864 linear 254:0 2048
VolumeGroup1-backups: 0 39059456 linear 254:0 181626880
sda5_crypt: 0 248109056 crypt aes-xts-plain64
00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
0 8:5 4096
VolumeGroup1-opt: 0 9764864 linear 254:0 54683648
VolumeGroup1-tmp: 0 9764864 linear 254:0 44918784
Is it expected?
Does I have to fully fill the encrypted partition (at least once) to
hide my datas?
FYI I verified TRIM and it seems really disabled:
root@o9020:/tmp# fstrim -v /tmp/
fstrim: /tmp/: FITRIM ioctl failed: Operation not supported
Thanks a lot for your help.
NB: I'm using Debian (Wheezy/Stable):
root@o9020:~# dpkg -l cryptsetup lvm2 dmsetup|tail -3
ii cryptsetup 2:1.4.3-4
amd64 disk encryption support - startup scripts
ii dmsetup 2:1.02.74-8
amd64 Linux Kernel Device Mapper userspace library
ii lvm2 2.02.95-8
amd64 Linux Logical Volume Manager
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [dm-crypt] Encrypted partitions with sectors to zero?
2013-10-23 14:24 Thomas Martin
@ 2013-10-23 18:04 ` Arno Wagner
0 siblings, 0 replies; 4+ messages in thread
From: Arno Wagner @ 2013-10-23 18:04 UTC (permalink / raw)
To: dm-crypt
On Wed, Oct 23, 2013 at 04:24:56PM +0200, Thomas Martin wrote:
> Hi everyone.
>
> I was trying to verify that discard (TRIM) was disabled on my system
> (new fresh install on a SSD) when I found some weird things.
>
> Indeed it seems I have many sectors to zero; example:
> root@o9020:~# hdparm --read-sector 54003000 /dev/sda
> /dev/sda:
> reading sector 54003000: succeeded
> 0000 0000 0000 0000 0000 0000 0000 0000
> 0000 0000 0000 0000 0000 0000 0000 0000
> 0000 0000 0000 0000 0000 0000 0000 0000
> ...
> 0000 0000 0000 0000 0000 0000 0000 0000
>
>
> According to me, only my /boot partition should have zero (as this is
> the only one unencrypted):
Encryption does not overwrite your data. If you want that
with LUKS or plain dm-crypt, ypu need to do the overwrite
yyourself. Some tools, like TrueCrypt, offer you to do
this optionally during installation.
See also FAQ item 5.3.
> root@o9020:~# parted /dev/sda "unit s print"
> Model: ATA LITEONIT LCS-128 (scsi)
> Disk /dev/sda: 250069680s
> Sector size (logical/physical): 512B/512B
> Partition Table: msdos
> Number Start End Size Type File system Flags
> 1 2048s 1953791s 1951744s primary ext4 boot
> 2 1955838s 250068991s 248113154s extended
> 5 1955840s 250068991s 248113152s logical
>
> root@o9020:~# lsblk /dev/sda -f
> NAME FSTYPE LABEL MOUNTPOINT
> sda
> ├─sda1 ext4 /boot
> ├─sda2
> └─sda5 crypto_LUKS
> └─sda5_crypt (dm-0) LVM2_member
> ├─VolumeGroup1-root (dm-1) ext4 /
> ├─VolumeGroup1-swap (dm-2) swap [SWAP]
> ├─VolumeGroup1-usr (dm-3) ext4 /usr
> ├─VolumeGroup1-tmp (dm-4) ext4 /tmp
> ├─VolumeGroup1-opt (dm-5) ext4 /opt
> ├─VolumeGroup1-var (dm-6) ext4 /var
> ├─VolumeGroup1-home (dm-7) ext4 /home
> └─VolumeGroup1-backups (dm-8) ext4 /backups
>
> root@o9020:~# dmsetup table
> VolumeGroup1-home: 0 97648640 linear 254:0 83978240
> VolumeGroup1-usr: 0 19529728 linear 254:0 25389056
> VolumeGroup1-var: 0 19529728 linear 254:0 64448512
> VolumeGroup1-swap: 0 15622144 linear 254:0 9766912
> VolumeGroup1-root: 0 9764864 linear 254:0 2048
> VolumeGroup1-backups: 0 39059456 linear 254:0 181626880
> sda5_crypt: 0 248109056 crypt aes-xts-plain64
> 00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
> 0 8:5 4096
> VolumeGroup1-opt: 0 9764864 linear 254:0 54683648
> VolumeGroup1-tmp: 0 9764864 linear 254:0 44918784
>
>
> Is it expected?
> Does I have to fully fill the encrypted partition (at least once) to
> hide my datas?
Yes. See FAQ item 5.3. If you do it for an already created
filesystem, you will not reach everything though, that is
why the overwrite should be done after crypto-mapping, but
before filesystem creation.
Arno
--
Arno Wagner, Dr. sc. techn., Dipl. Inform., Email: arno@wagner.name
GnuPG: ID: CB5D9718 FP: 12D6 C03B 1B30 33BB 13CF B774 E35C 5FA1 CB5D 9718
----
There are two ways of constructing a software design: One way is to make it
so simple that there are obviously no deficiencies, and the other way is to
make it so complicated that there are no obvious deficiencies. The first
method is far more difficult. --Tony Hoare
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2013-10-24 11:53 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-10-24 7:33 [dm-crypt] Encrypted partitions with sectors to zero? Thomas Martin
2013-10-24 11:53 ` Arno Wagner
-- strict thread matches above, loose matches on Subject: below --
2013-10-23 14:24 Thomas Martin
2013-10-23 18:04 ` Arno Wagner
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox