Re:Cryptsetup 2.0.0 introduces new on-disk LUKS2 format
by sslalready on Monday December 25, 2017 @01:14PM
(#16005095)
I think TRIM is dangerous not because of information leaks, but because of the risk of IV/nonce reuse when SSD data blocks are unmapped but not cleared. This would pose a risk if someone dumps the raw content of the NAND chips and find two or more data blocks encrypted with the same IV/nonce.
[ Parent
| on HN ]
Re:Cryptsetup 2.0.0 introduces new on-disk LUKS2 format
by viraptor on Monday December 25, 2017 @08:19PM
(#16006512)
Why does trim make a difference though? You're not going to scan the whole disk on each write for duplicates, so you need to guarantee statistically-unique nonces either way, or make sure reuse doesn't matter. Trim doesn't make this any worse/better.
Re:Cryptsetup 2.0.0 introduces new on-disk LUKS2 format
by viraptor on Tuesday December 26, 2017 @12:11AM
(#16007198)
After some time, I think I get it. If the key/iv is location-specific, trim may result in an abandoned block which will then be recreated somewhere else. This results in two blocks from the same logical location in two different flash locations. Unless I misunderstand something, the xts mode encryption uses location-based keys.