[dm-crypt] encrypted SWAP FAQ item

[dm-crypt] encrypted SWAP FAQ item

[Arno Wagner]

Dear all,

I just have added a mini-HOWOT on how to set up encrypted swap
in FAQ item 2.2:
http://code.google.com/p/cryptsetup/wiki/FrequentlyAskedQuestions

Proofreading and suggestions welcome. 

Arno
-- 
Arno Wagner,     Dr. sc. techn., Dipl. Inform.,    Email: arno@wagner.name
GnuPG: ID: CB5D9718  FP: 12D6 C03B 1B30 33BB 13CF  B774 E35C 5FA1 CB5D 9718
----
There are two ways of constructing a software design: One way is to make it
so simple that there are obviously no deficiencies, and the other way is to
make it so complicated that there are no obvious deficiencies. The first
method is far more difficult.  --Tony Hoare

Re: [dm-crypt] encrypted SWAP FAQ item

[.. ink ..]

[-- Attachment #1: Type: text/plain, Size: 442 bytes --]

On Thu, Jul 11, 2013 at 2:53 AM, Arno Wagner <arno@wagner.name> wrote:

> Dear all,
>
> I just have added a mini-HOWOT on how to set up encrypted swap
> in FAQ item 2.2:
> http://code.google.com/p/cryptsetup/wiki/FrequentlyAskedQuestions
>
> Proofreading and suggestions welcome.
>
>
i just gazed over it and noticed a typo "sisks" instead of "disks".Its on
the second line on the paragraph that starts with "Warning: While Debian
refuse..."

[-- Attachment #2: Type: text/html, Size: 908 bytes --]

Re: [dm-crypt] encrypted SWAP FAQ item

[Arno Wagner]

Thanks, fixed.

Arno

On Thu, Jul 11, 2013 at 03:14:26AM -0400, .. ink .. wrote:
> On Thu, Jul 11, 2013 at 2:53 AM, Arno Wagner <arno@wagner.name> wrote:
> 
> > Dear all,
> >
> > I just have added a mini-HOWOT on how to set up encrypted swap
> > in FAQ item 2.2:
> > http://code.google.com/p/cryptsetup/wiki/FrequentlyAskedQuestions
> >
> > Proofreading and suggestions welcome.
> >
> >
> i just gazed over it and noticed a typo "sisks" instead of "disks".Its on
> the second line on the paragraph that starts with "Warning: While Debian
> refuse..."

> _______________________________________________
> dm-crypt mailing list
> dm-crypt@saout.de
> http://www.saout.de/mailman/listinfo/dm-crypt


-- 
Arno Wagner,     Dr. sc. techn., Dipl. Inform.,    Email: arno@wagner.name
GnuPG: ID: CB5D9718  FP: 12D6 C03B 1B30 33BB 13CF  B774 E35C 5FA1 CB5D 9718
----
There are two ways of constructing a software design: One way is to make it
so simple that there are obviously no deficiencies, and the other way is to
make it so complicated that there are no obvious deficiencies. The first
method is far more difficult.  --Tony Hoare

Re: [dm-crypt] encrypted SWAP FAQ item

[Justin Tracey]

Another small typo at "Note: The "noearly" optiom" should presumably be 
"option".
Nice guide, thanks.

  - Justin

On 07/10/2013 11:53 PM, Arno Wagner wrote:
> Dear all,
>
> I just have added a mini-HOWOT on how to set up encrypted swap
> in FAQ item 2.2:
> http://code.google.com/p/cryptsetup/wiki/FrequentlyAskedQuestions
>
> Proofreading and suggestions welcome.
>
> Arno

Re: [dm-crypt] encrypted SWAP FAQ item

[Arno Wagner]

Fixed. Thanks!

Arno

On Thu, Jul 11, 2013 at 12:59:10AM -0700, Justin Tracey wrote:
> Another small typo at "Note: The "noearly" optiom" should presumably
> be "option".
> Nice guide, thanks.
> 
>  - Justin
> 
> On 07/10/2013 11:53 PM, Arno Wagner wrote:
> >Dear all,
> >
> >I just have added a mini-HOWOT on how to set up encrypted swap
> >in FAQ item 2.2:
> >http://code.google.com/p/cryptsetup/wiki/FrequentlyAskedQuestions
> >
> >Proofreading and suggestions welcome.
> >
> >Arno
> 
> _______________________________________________
> dm-crypt mailing list
> dm-crypt@saout.de
> http://www.saout.de/mailman/listinfo/dm-crypt

-- 
Arno Wagner,     Dr. sc. techn., Dipl. Inform.,    Email: arno@wagner.name
GnuPG: ID: CB5D9718  FP: 12D6 C03B 1B30 33BB 13CF  B774 E35C 5FA1 CB5D 9718
----
There are two ways of constructing a software design: One way is to make it
so simple that there are obviously no deficiencies, and the other way is to
make it so complicated that there are no obvious deficiencies. The first
method is far more difficult.  --Tony Hoare

Re: [dm-crypt] encrypted SWAP FAQ item

[Jonas Meurer]

Heya,

Am 11.07.2013 08:53, schrieb Arno Wagner:
> Dear all,
> 
> I just have added a mini-HOWOT on how to set up encrypted swap
> in FAQ item 2.2:
> http://code.google.com/p/cryptsetup/wiki/FrequentlyAskedQuestions
> 
> Proofreading and suggestions welcome. 

Good idea to add it to the FAQ. Thanks for maintaining this very
valuable piece of documentation.

But maybe you should more emphasize the fact that /etc/crypttab
implementations are distro-specific. While I know for sure that options
like swap and noearly are supported in Debian-based distributions, I'm
not sure about Redhat-based ones. Last time I looked, only a small
subset of crypttab options that we've implemented in Debian were
supported on Redhat-based systems.

Additionally, the following sentence looks wrong to me:

"Note: use /dev/random if you are paranoid or in a potential low-entropy
situation (embedded system, etc.).".

Mainly in low-entropy situations /dev/random would cause the boot
process to hang, right? So for these setups /dev/urandom actually is the
better solution. Granted that one isn't paranoid ;)

Kind regards,
 jonas

Re: [dm-crypt] encrypted SWAP FAQ item

[Milan Broz]

On 07/11/2013 11:24 AM, Jonas Meurer wrote:
> Heya,
>
> Am 11.07.2013 08:53, schrieb Arno Wagner:
>> Dear all,
>>
>> I just have added a mini-HOWOT on how to set up encrypted swap
>> in FAQ item 2.2:
>> http://code.google.com/p/cryptsetup/wiki/FrequentlyAskedQuestions
>>
>> Proofreading and suggestions welcome.
>
> Good idea to add it to the FAQ. Thanks for maintaining this very
> valuable piece of documentation.
>
> But maybe you should more emphasize the fact that /etc/crypttab
> implementations are distro-specific. While I know for sure that options
> like swap and noearly are supported in Debian-based distributions, I'm
> not sure about Redhat-based ones. Last time I looked, only a small
> subset of crypttab options that we've implemented in Debian were
> supported on Redhat-based systems.

Fedora (and future RHEL, perhaps) is using systemd,
crypttab is parsed in systemd. IIRC most of the options are
"systemd standardized". IIRC all Debian keywords were already there.

And for swap... it never worked properly with systemd but it is implementation
bug prhaps only, enjoy reading
https://bugzilla.redhat.com/show_bug.cgi?id=759402

(systemd is using libcryptsetup for real device activation)

> Additionally, the following sentence looks wrong to me:
>
> "Note: use /dev/random if you are paranoid or in a potential low-entropy
> situation (embedded system, etc.).".
>
> Mainly in low-entropy situations /dev/random would cause the boot
> process to hang, right? So for these setups /dev/urandom actually is the
> better solution. Granted that one isn't paranoid ;)

This is not so simple. Once /dev/random is "fixed" for most configs
(read: internal pool is continuously mixed with good entropy source like
e.g. RDRAND instructions) cryptsetup will switch default to /dev/random
(for long-live keys). Perhaps in next major version.

See my notes here http://code.google.com/p/cryptsetup/issues/detail?id=161

Milan

Re: [dm-crypt] encrypted SWAP FAQ item

[Arno Wagner]

On Thu, Jul 11, 2013 at 11:24:22AM +0200, Jonas Meurer wrote:
> Heya,
> 
> Am 11.07.2013 08:53, schrieb Arno Wagner:
> > Dear all,
> > 
> > I just have added a mini-HOWOT on how to set up encrypted swap
> > in FAQ item 2.2:
> > http://code.google.com/p/cryptsetup/wiki/FrequentlyAskedQuestions
> > 
> > Proofreading and suggestions welcome. 
> 
> Good idea to add it to the FAQ. Thanks for maintaining this very
> valuable piece of documentation.

Thanks!
 
> But maybe you should more emphasize the fact that /etc/crypttab
> implementations are distro-specific. While I know for sure that options
> like swap and noearly are supported in Debian-based distributions, I'm

Well, if "swap" is not supported, then this will just fail. In
this case, the user will likely have to write his/her own
startup-script. Same with noearly, it will simply fail if the
device is not yet available because it needs LVM or RAID-assembly.

I will see about saying this clearer though.

> not sure about Redhat-based ones. Last time I looked, only a small
> subset of crypttab options that we've implemented in Debian were
> supported on Redhat-based systems.
> 
> Additionally, the following sentence looks wrong to me:
> 
> "Note: use /dev/random if you are paranoid or in a potential low-entropy
> situation (embedded system, etc.).".
> 
> Mainly in low-entropy situations /dev/random would cause the boot
> process to hang, right? So for these setups /dev/urandom actually is the

No. It hangs only in a "no entropy" situation. With "low entropy",
it merely takes long. In a "no entropy" situation, you cannot do 
secure encryption and should do without it or find some entropy.
Also note that a pre-seeded /dev/urandom is not a "low entropy"
situation. 
 
> better solution. Granted that one isn't paranoid ;)

Not "better", faster. But catastrophically worse with
regard to security. If you do not care about security
in swap it is better to not encrypt it in the first 
place. But if you encrypt, then it must be secure. 
Otherwise people will make wrong assumptions.

History has shown time and again that having no security in 
place makes (most) people careful, but having very weak security 
in place gives them a false sense of security, which is a lot 
worse. Hence do encryption right or do without it.

Arno
-- 
Arno Wagner,     Dr. sc. techn., Dipl. Inform.,    Email: arno@wagner.name
GnuPG: ID: CB5D9718  FP: 12D6 C03B 1B30 33BB 13CF  B774 E35C 5FA1 CB5D 9718
----
There are two ways of constructing a software design: One way is to make it
so simple that there are obviously no deficiencies, and the other way is to
make it so complicated that there are no obvious deficiencies. The first
method is far more difficult.  --Tony Hoare

Re: [dm-crypt] encrypted SWAP FAQ item

[octane indice]

En réponse à Arno Wagner <arno@wagner.name> :
> ------------------ Début du message d'origine --------------------
> 
> Dear all,
> 
> I just have added a mini-HOWOT on how to set up encrypted swap
> in FAQ item 2.2:
> http://code.google.com/p/cryptsetup/wiki/FrequentlyAskedQuestions
> 
> Proofreading and suggestions welcome. 
> 
As said, /etc/crypttab is very distro specific.
For the record, slackware uses:

swap /dev/sdaX /dev/random swap,cipher=aes-xts-essiv:sha256

Another things really nice is done at shutdown: it mkswap the
partition. So, if you multiboot, you can use the swap the way
you want: clear for unencrypted distribution, and ciphered
for the crypted one.

> Arno
> -- 
> Arno Wagner,     Dr. sc. techn., Dipl. Inform.,    Email:
> arno@wagner.name
> GnuPG: ID: CB5D9718  FP: 12D6 C03B 1B30 33BB 13CF  B774 E35C
> 5FA1 CB5D 9718
> ----
> There are two ways of constructing a software design: One way
> is to make it
> so simple that there are obviously no deficiencies, and the
> other way is to
> make it so complicated that there are no obvious deficiencies.
> The first
> method is far more difficult.  --Tony Hoare
> _______________________________________________
> dm-crypt mailing list
> dm-crypt@saout.de
> http://www.saout.de/mailman/listinfo/dm-crypt
> 
> ------------------- Fin du message d'origine ---------------------



Envoyé avec Inmano, ma messagerie renversante et gratuite : http://www.inmano.com

Re: [dm-crypt] encrypted SWAP FAQ item

[Robert Nichols]

On 07/11/2013 01:53 AM, Arno Wagner wrote:
> I just have added a mini-HOWOT on how to set up encrypted swap
> in FAQ item 2.2:
> http://code.google.com/p/cryptsetup/wiki/FrequentlyAskedQuestions

There are now two sections numbered 2.2.

-- 
Bob Nichols     "NOSPAM" is really part of my email address.
                 Do NOT delete it.