From: Milan Broz <mbroz@redhat.com>
To: dm-crypt@saout.de
Subject: Re: [dm-crypt] Question regarding LUKS
Date: Thu, 20 Oct 2011 10:43:54 +0200 [thread overview]
Message-ID: <4E9FDF4A.9080402@redhat.com> (raw)
In-Reply-To: <20111020081835.GA26340@tansi.org>
On 10/20/2011 10:18 AM, Arno Wagner wrote:
> I don't think anybody ever invested the money needed
> to find out.
Well, maybe you noticed some changes in dmcrypt and even
cryptsetup which were directly closely related
to this problem.
AFAIK FIPS 140-2 is always related to some hw config,
but in principle (and if you define cryptographic boundaries
properly) dm-crypt and LUKS have no serious issues here.
The main problem is proper RNG and crypto use (you have
to use only approved RNG and only certified crypto library),
and it cannot be isolated from the kernel certification etc.
So there are no principal problems I know about but
still some changes are needed (some of them are really
formal).
Milan
next prev parent reply other threads:[~2011-10-20 8:43 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-10-19 16:55 [dm-crypt] Question regarding LUKS King, Al
2011-10-20 8:18 ` Arno Wagner
2011-10-20 8:43 ` Milan Broz [this message]
2011-10-20 11:02 ` Arno Wagner
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4E9FDF4A.9080402@redhat.com \
--to=mbroz@redhat.com \
--cc=dm-crypt@saout.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox