Messages in this thread | | | From | (David Wagner) | Subject | Re: [PATCH] Delete cryptoloop | Date | Mon, 2 Aug 2004 22:54:48 +0000 (UTC) |
| |
Matt Mackall wrote: >Here's a probable scenario: encrypted mail spool in maildir format. >Attacker can send mail of his choosing and then later capture the >machine with the hope of breaking in.
No, actually, that's the kind of simple scenario where existing Cryptoloop does a more or less reasonable job (in my opinion). In a simple scenario, the attacker can choose or exert partial control over some of the data stored on your disk, then can steal your hard disk and see what is stored on it, and you never see the hard disk again. This is the scenario where Saarinen's watermarking attack is possible, and if you're unlucky there may be some partial information leakage as detailed in my previous email, but nothing much worse than this (as far as I know).
The point I was making is that there are other scenarios where Cryptoloop falls apart in much more devastating ways. For instance, if the attacker can modify the ciphertexts stored on your hard disk and you continue using the hard disk afterwards, then really nasty attacks become possible. Other attacks become possible if the attacker can observe the ciphertexts stored on your hard disk at multiple points in time. The question I was asking is this: Does anyone care about these latter types of scenarios?
>Ideally, we'd ship a requirements and specification document that >describes the security trade-offs of cryptoloop/dm-crypt in some >detail. There are way too many unstated assumptions here.
Yes, that sounds like something that would make a lot of sense. - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |