Re: [dm-crypt] Some questions about cryptsetup 1.6.x

[Milan Broz <gmazyland@gmail.com>]

Hi,

just adding few facts, the discussion is already elsewhere in thread:)

On 02/12/2014 10:49 AM, Cpp wrote:
> Next I'd like to ask about the memory management of the master key.
> Suppose I mounted a volume using luksOpen (or --type luks open). What
> happens when I invoke luksClose (close) on that container? Does the
> master key get securely erased from memory (several overwrites with
> random data) or is it simply blanked out (single overwrite with
> zeros)?

The luksClose / dmsetup remove or any other correct dmcrypt device close
will cause removal of key from memory, with simple zeroing that part.

> How is the master key stored in memory? I read somewhere that having
> the same data in the exact same location in RAM for an extended period
> of time (like a 24/7 server) can "burn in" the data into the RAM
> module, which can be later recovered. Is this of any concern with
> current cryptsetup i.e. for attacks like cold boot?

In fact, it is stored in memory in several places. First, copy of
it in dmcrypt internal structures and then inside crypto API
(usually several times - depend on level of parallelism of crypto module).
 
> Finally I'm interested to know about removing all the keyslots.
> Suppose I mounted a container and erased every available keyslot
> (please don't ask why). I know this would in theory make the data
> irrecoverble, but the container is still mounted for the time being.
> Assuming that the power doesn't disappear, is there a way to
> reintroduce a new key slot into the LUKS container after all slots
> have been erased, provided that the container is mounted and I can
> read the master key from memory?

Yes. You can recreate LUKS header, I wrote some script to do this,
it is part of cryptsetup source code
http://code.google.com/p/cryptsetup/source/browse/misc/luks-header-from-active

(I hope is still works though ;-)

Milan