Collaborate Disseminate
Most of the online guides I found about using dm-crypt with a random keyfile use files bigger than 512 bits (64 bytes).
For example:
dd bs=512 count=4 if=/dev/urandom of=keyfile iflags=fullblock
As the biggest key a cipher can use is 512 … Continue reading Is there any added benefit to using a random keyfile of more than 512 bits?
I’ve been looking to purchase a new laptop and I need to have security in mind. I’ve specifically been looking for laptops with discrete or integrated TPM because it’s been my understanding that TPM would improve disk encryption security, … Continue reading How safe is dm-crypt/LUKS? Would TPM make me more secure in this case?
Does it make sense to combine ZFS with LUKS2 for completely random-looking encryption on HDDs ? (Without luks-header on the disk of course, header placed elsewhere). The goal is to make a HDD really look like random data, since as I’ve lea… Continue reading ZFS on LUKS2 encrypted device: LuksFormat with or without dm-integrity?
I am backing up my files to a RAID mirrored HDD, that has full disk encryption (FDE) in place with LUKS. Until now I did this with rsync, but I recently switched to a new backup program that does file level encryption as well.
So my questi… Continue reading Drawback of Multi Level Encryption
I’ve been instructed to use the state of our system’s TPM’s PCR registers to prevent the system we’re working on from booting if one of the PCR registers is different from what we expect. In service of that goal, I’m reading over this arti… Continue reading What kind of "actions" can a TPM2 policy authorize?
When setting up LUKS2 using an AEAD mode on a large disk (5+TB), it can take well over a day to add an authentication tag to every block, especially given the slower nature of AEAD algorithms (for now). I’ve been thinking about how to defe… Continue reading Deferring AEAD setup on large disks in LUKS2
I just added a drive to my system which is basically a partition mounted for extra storage. I’d like to encrypt it to protect my data in case of god knows what, and by doing that I’d need to enter the passphrase every time to unlock the pa… Continue reading Aren’t keyfiles defeating the purpose of encryption?
I installed a default installation of manjaro, with full disk LUKS encryption enabled. It works fine, every time I start my system I’m asked for a password
Well I’d like to stop being asked for a password and instead using a keyfile from … Continue reading HOW TO: Manjaro LUKS encryption with a keyfile from a pendrive [migrated]
I find cryptsetup to have an inconsistent way of dealing with headers, I’m tempted to call it a bug
I would like to achieve a very large LUKS offset without resulting in a very bulky detached header
Here is what I’ve tried:
$ cryptsetup -… Continue reading LUKS – Too large detached header size when large offset
Is it possible to store the master decryption key for accessing a LUKS encrypted volume inside an SGX enclave so that the master key cannot be accessed by any user on the system, even the root user with privileges to make system calls?