Re: [PATCH] Delete cryptoloop

[daw@taverner.cs.berkeley.edu (David Wagner)]

Matt Mackall  wrote:
>Here's a probable scenario: encrypted mail spool in maildir format.
>Attacker can send mail of his choosing and then later capture the
>machine with the hope of breaking in.

No, actually, that's the kind of simple scenario where existing Cryptoloop
does a more or less reasonable job (in my opinion).  In a simple scenario,
the attacker can choose or exert partial control over some of the data
stored on your disk, then can steal your hard disk and see what is stored
on it, and you never see the hard disk again.  This is the scenario where
Saarinen's watermarking attack is possible, and if you're unlucky there
may be some partial information leakage as detailed in my previous email,
but nothing much worse than this (as far as I know).

The point I was making is that there are other scenarios where Cryptoloop
falls apart in much more devastating ways.  For instance, if the attacker
can modify the ciphertexts stored on your hard disk and you continue
using the hard disk afterwards, then really nasty attacks become possible.
Other attacks become possible if the attacker can observe the ciphertexts
stored on your hard disk at multiple points in time.  The question I was
asking is this: Does anyone care about these latter types of scenarios?

>Ideally, we'd ship a requirements and specification document that
>describes the security trade-offs of cryptoloop/dm-crypt in some
>detail. There are way too many unstated assumptions here.

Yes, that sounds like something that would make a lot of sense.