Show HN: Puree – Password-based Uniform-Random-Equivalent Encryption

Re:Show HN: Puree – Password-based Uniform-Random-Equivalent... by chc4 on Sunday June 07, 2020 @01:36PM (#23449043)

You can also simply have LUKS with a detached header - I know some people that have their header and boot partitions exclusively on a USB, so that it's required to be in possession of the USB key to unlock and boot your computer.

[ Parent | on HN ]

Re:Show HN: Puree – Password-based Uniform-Random-Equivalent... by notfed on Sunday June 07, 2020 @01:52PM (#23449159)

I called this out in the PUREE paper:

> To be fair, some tools do support support completely-random-looking disk layouts, but in most cases, they either:

> 1. Are key-based (e.g., require a 128-bit or 256-bit key) rather than password based, in which case, the key must stored elsewhere. (Where do you store the key?)

> 2. Ask the user to store a (non-random-looking) disk-encryption header elsewhere (i.e., “detached header mode”). (Where do you store the header?)

[ Parent | on HN ]

Re:Show HN: Puree – Password-based Uniform-Random-Equivalent... by tempay on Sunday June 07, 2020 @07:30PM (#23452023)

> 1. Are key-based (e.g., require a 128-bit or 256-bit key) rather than password based, in which case, the key must stored elsewhere. (Where do you store the key?)

Is there a reason why this is notably different? Why can't the password be hashed to get the fixed length key?

[ Parent | on HN ]

Re:Show HN: Puree – Password-based Uniform-Random-Equivalent... by viraptor on Sunday June 07, 2020 @08:08PM (#23452263)

Yes, it's a pretty standard approach. I can't even recall anything that uses passwords directly these days. Mostly due to world relying mainly on aes where you have to derive the key.

[ Parent | on HN ]

Re:Show HN: Puree – Password-based Uniform-Random-Equivalent... by jcynix on Monday June 08, 2020 @03:41AM (#23454455)

> 2. Ask the user to store a (non-random-looking) disk-encryption header elsewhere (i.e., “detached header mode”). (Where do you store the header?)

If the header isn't needed on a daily basis, storing it as a QR-Code on paper would be a possibility.

[ Parent | on HN ]

Re:Show HN: Puree – Password-based Uniform-Random-Equivalent... by comboy on Sunday June 07, 2020 @01:42PM (#23449094)

Be careful with that solution, you then have to have a separate backup strategy for that USB data.

[ Parent | on HN ]

Re:Show HN: Puree – Password-based Uniform-Random-Equivalent... by OJFord on Sunday June 07, 2020 @02:46PM (#23449571)

Only if the computer has important (and not backed up/replicated) state.

[ Parent | on HN ]

Re:Show HN: Puree – Password-based Uniform-Random-Equivalent... by dkdk8283 on Sunday June 07, 2020 @04:41PM (#23450616)

Exactly, and that backup strategy is likely to be the weak link.

[ Parent | on HN ]

Re:Show HN: Puree – Password-based Uniform-Random-Equivalent... by xwdv on Sunday June 07, 2020 @04:35PM (#23450570)

Throw it in an S3 bucket. Done.

[ Parent | on HN ]