Re: [PATCH] Delete cryptoloop

Marc Ballarin
2004-07-26T22:06:01Z

Fruhwirth Clemens <clemens-dated-1091709927.ed82 <at> endorphin.org> writes:

> To summarize for an innocent bystander:
>
> - The attacks you brought forward are in the best case a starting point
> for known plain text attacks. Even DES is secure against this attack,
> since an attacker would need 2^47 chosen plain texts to break the cipher
> via differential cryptanalysis. (Table 12.14 Applied Cryptography,
> Schneier). First, the watermark attack can only distinguish 32
> watermarks. Second, you'd need a ~2.000.000 GB to store 2^47 chosen
> plain texts. Third, I'm talking about DES (designed 1977!), no chance
> against AES.
>

>From what I understand now, this exploit is solely based on the weakness of
dm-crypt's/cryptoloops IV generation.

The difference in bit patterns between the first and second half of the
watermark block compensates partly for the trivially and predictably changing
IV beetween two successive sectors.
As Jari eplained, this causes *any* cipher to produce two identical blocks of
ciphertext (after all the input is identical).
This is also, why this exploit requires a minimum filesystem block size of 1kB
for good reliability.

> - The weaknesses brought forward by me are summarized at
> http://clemens.endorphin.org/OnTheProblemsOfCryptoloop . Thanks goes to
> Pascal Brisset, who pointed out that cryptoloop is actually more secure
> than I assumed.
>

If my understanding is correct, an improved and unpredictable IV generation -
- as needed anyway for the vulnerability described at
http://clemens.endorphin.org/OnTheProblemsOfCryptoloop -
*should* protect against this watermarking as well. So both problems can be
fixed together and rather easily.

Regards