Collaborate Disseminate
When installing Debian, I chose an option to create Encrypted LVM (Logical Volume Management). So now, when I turn on my PC, it asks me for an encryption password.
It looks ok, but how does it work? What does GRUB initializ… Continue reading How does default Debian boot drive encryption works?
I’ve been searching for quite a while now for a Linux disk encryption scheme that supports TPM by default.
I understand that everybody loves LUKS and I do too. However in order to get LUKS to work with TPM you it requires a … Continue reading Linux OS encryption with TPM? [on hold]
I spent several days trying to figure out how to securely decrypt a hard drive on remote location using TPM2.0 in Linux. I’m no security expert and this is my first battle with TPM2.0. I learned a lot, but I still have questions. Could som… Continue reading Use TPM2.0 to securely decrypt the hard drive in Linux — unattended
I need to protect a few hundred thousand files stored on a drive on a Linux server. I am thinking full disk encryption with file encryption on top would be the best option. Failing that, file based encryption would be the nex… Continue reading Full disk encryption vs file based encryption
I’ve heard that there are attacks that can get passwords out of RAM while turned on.
If a server, CentOS 7.5 and LUKS enabled, it’s tty1 locked, which is on a VMWare hypervisor that is locked with a password, is gained acces… Continue reading Can government authorities retrieve data from LUKS volume when it’s accessed while turned on?
Situation: A Desktop Linux (eg. Debian, Xfce desktop, Lightdm login) with LUKS-encrypted partitions (as far as possible, eg. Efi files are not encrypted of course).
The computer is in sleep mode (not hibernate, ie. Luks in un… Continue reading Luks+Sleep: Login screen security?
I am using Debian 9.5, Linux Kernel 4.16, I would like to use the dm-integrity feature with cryptsetup.
cryptsetup luksFormat –type luks2 <device> –cipher aes-gcm-random –integrity aead
Nevertheless, I can not figure out how to… Continue reading LUKS2 dm-integrity
I am using LUKS over RAID0. I have executed cryptsetup -v –cipher aes-xts-plain64 –key-size 512 –hash sha256 –iter-time 2000 –use-urandom –verify-passphrase luksFormat /dev/md0
Everything shows me that the partition i… Continue reading dmcryt_write process in TOP but no WRDSK indicated
There are numerous recommendations for how frequently to change users’ passphrases, and I think the most recent NIST recommendation is “no minimum time to change passwords” (I might be mis-quoting). Are the recommendations an… Continue reading recommendation to change encrypted-drive passphrases
I am building an encrypted NAS with 4 x 4TB hard drives and was wondering what the limit of 256 bit AES is when implemented via cryptsetup and luksFormat. As I understand it, the maximum plaintext size for 256 bit AES is 2^39… Continue reading Limit of 256 bit drive encryption? 512 needed for large drives?