Messages in this thread | | | Subject | Re: [PATCH] Delete cryptoloop | Date | Sat, 24 Jul 2004 14:41:46 +0200 | From | Fruhwirth Clemens <> |
| |
On Wed, 2004-07-21 at 22:16, James Morris wrote: > This patch deletes cryptoloop, which is buggy, unmaintained, and > reportedly has mutliple security weaknesses. Dropping cryptoloop should > also help dm-crypt receive more testing and review.
Short version: Remove cryptoloop || mark as deprecated.
Long version: First, dm-crypt and cryptoloop share the same on-disk format. There is absolutely no security gain by switching to dm-crypt.
Second, modern ciphers like Twofish || AES are designed to resist known-plaintext attacks. This is basically the FUD spread by Jari Rusuu. But, due to a recent discussion on sci.crypt, I have been convinced that there is in fact a security gain by obscuring the IV. To be precise, if an attacker is able to find two identical cipher blocks on disk, he will be able to deduce the plain text difference. The chance p that two blocks are equal is p=1/2^128 for 128 bit block ciphers. If one of these blocks happens to be zero this is quite bad. The chance that there are no identical cipher blocks on a disk is given by p^(n(n-1)/2) with n = numbers of sectors on disk. Anyone with a little bit math intuition can see this terms will approach 0 quite quick. So it is likely that some information is revealed.
This situation will not be cured by switching to dm-crypt, since dm-crypt suffers from the same kind of problem. Although personally, I neglect this security threat.
However, I do recommend that cryptoloop is removed from the kernel || is declared deprecated for the following reasons:
- There is no suitable user space tool ready to use it. util-linux has been broken ever since. My patch key-trunc-fix patch has to be applied to make any use of losetup. Further I'm not going to submit patches to this project to fix user space problems (see below)
- I'm not going to submit patches to cure the security problems of cryptoloop pointed out in the first few paragraphs,
- dm-crypt is a stable alternative and can be easily immigrated to with the help of my little lotracker tool: http://clemens.endorphin.org/lo-tracker
So much for cryptoloop.
I'd like to point out that in the most cases the key deduction scheme is more likely the weakest component in a hard disk encryption setup. For those interested: http://clemens.endorphin.org/TKS1-draft.pdf points to the problems connect with HD encryption. This paper is the groundwork for my Linux Unified Key Setup project http://clemens.endorphin.org/LUKS . Here, you will find patches for cryptsetup (the losetup equivalent to losetup). I'm working with Christophe Saout to integrate LUKS into cryptsetup in the near future.
Regards, -- Fruhwirth Clemens <clemens@endorphin.org> http://clemens.endorphin.org [unhandled content-type:application/pgp-signature] | |