Collaborate Disseminate
UPDATED Summary: I’m looking at Linux FDE options that are transparent to the user (my parents) in that the user doesn’t need to enter 2 passwords. I found/thought of several options and tried to think through the security implications of … Continue reading How good/bad are these transparent Linux consumer FDE setup options? (e.g. for auto-unlocking LUKS)
I use Fedora Linux and was recently looking into doing Full Disk Encryption on data drives such as /home on some of my / my family’s PCs. I understand that LUKS security will be partially dependent on having strong passwords and not doing … Continue reading Is LUKS still an effective option for consumer FDE considering Elcomsoft can break it?
Firstly, I do not think my question is answered by SSD full disk encryption as I am not looking for a binary "is FDE secure" – nothing is perfectly secure; rather I am looking for possible solutions to the specific SSD/FDE encryp… Continue reading Linux/LUKS/Full Disk Encryption: How can I mitigate SSD/flash media security security risk caused by unreliable physical deletion?
I want to increase the time it would take to brute force my full disc encryption. I’m on Ubuntu and encrypted with Luks on installation. I have read that I would use the following command to make it so that only one password could be enter… Continue reading Increase Time to Brute Force Luks Full Disk Encryption [migrated]
Is there any remote FDE decryption that is resistant to an attacker that has local physical access?
Tools like dracut-sshd need to store the private key used for the sshd server on the unencrypted boot partition, so a local attacker has th… Continue reading Security against local attack for remote FDE decryption?
I gather from the cryptsetup manpages that LUKS2 uses argon2i by default for strengthening a user-password to decrypt the partition. However if a 256 bit keyfile with data from /dev/random, how does a KDF make guessing that password harder… Continue reading Do LUKS2 encrypted partitions with Keyfiles use a KDF?
Context
I’m working on the hardening of a Debian Bullseye box.
At the moment, every works perfectly: SecureBoot enabled, "Admin" password for BIOS set, every partitions except EFI one are ciphered with Luks, i flashed my own keys… Continue reading SecureBoot: PCR to use or not
A simple way of automatically decrypting system drive at boot time:
clevis luks bind -d /dev/yourdrive tpm2 ‘{"pcr_ids":"4,5"}’
systemctl enable clevis-luks-askpass.path
When I booted another OS on the same machine, tp… Continue reading Is it secure to automatically unlock encrypted system drive using the TPM PCR values?
I am trying to encrypt one of my primary Linux partition (5GB) by following this example to encrypt.
I want to confirm some of my understandings:
Salt is automatically generated by cyrptsetup with luks?
–iter-time and –hash only affects… Continue reading dm-crypt 2.0.3 + luks: salt auto-generated? what affects decryption speed?
What is the best place to store certificates and keys which are confidential and sensitive?
As I understand LUKS is fine and kernel transparently handles encryption/decryption. Also, the LUKS volume could contain anything and everything li… Continue reading Better security for storing certificates in LUKS or softhsm?