PSA: Upgrade your LUKS key derivation function

Re:PSA: Upgrade your LUKS key derivation function by mjg59 on Tuesday April 18, 2023 @06:11AM (#35612043)

The presumption that 20 characters is any meaningful amount of entropy is based on the password actually being somewhat random, and there's no fundamental reason to believe that that's true. I tend towards brute forcing not being the most likely reason for this, but the indisputable reality is that any combination of weak passwords and PBKDF2 makes it plausible (if not necessarily likely) that an adversary with a sufficiently large hardware budget can break disk encryption.

[ Parent | on HN ]

Re:PSA: Upgrade your LUKS key derivation function by aborsy on Tuesday April 18, 2023 @07:42AM (#35612660)

You don’t need to merely tend towards. You just can’t brute force a random 20 characters password of the type that he mentioned. Brute force is almost never used, even with half of entropy of such password.

His password was intercepted, or was embarrassingly deterministic.

[ Parent | on HN ]

Re:PSA: Upgrade your LUKS key derivation function by raverbashing on Tuesday April 18, 2023 @08:23AM (#35613031)

Or something like, notebook still had the keys in memory when it was recovered

Though from this description it looks like they read the disk (trivial) but it's not sure if they actually pulled anything from it (at least it seems they didn't pull anything incriminating if I read it correctly).

[ Parent | on HN ]

Re:PSA: Upgrade your LUKS key derivation function by mort96 on Tuesday April 18, 2023 @10:49AM (#35614742)

I didn't see anyone mention a random 20 characters password. I saw 20 character password with symbols and upper and lower case. That might be 4 words strung together "correct horse battery staple" style.

[ Parent | on HN ]

Re:PSA: Upgrade your LUKS key derivation function by mjg59 on Tuesday April 18, 2023 @02:45PM (#35618166)

A stronger KDF would plausibly have protected him even if his password was embarrassingly deterministic.

[ Parent | on HN ]

Re:PSA: Upgrade your LUKS key derivation function by stouset on Tuesday April 18, 2023 @05:48PM (#35620785)

Maybe. But probably not.

If they were using a crib sheet to the point of only trying 1m attempts, this can be done in “days” with one CPU even if PBKDF2 is set to take one second each attempt on that CPU.

A “better” KDF isn’t fundamentally going to change this. It’s just going to enforce stricter limits on any time-memory trade offs and require more memory. Neither of these are going to be meaningful differences when you’re cracking a single password for a single user with a crib sheet, unless you’re in the realm of billions or more guesses.

[ Parent | on HN ]

Re:PSA: Upgrade your LUKS key derivation function by AlexCoventry on Tuesday April 18, 2023 @04:12PM (#35619370)

If the computer is suspended at the time it's seized, does it become easier to recover the FDE key from the computer's memory? Or is that encrypted with the user password, or something like that? (On stock ubuntu, say.)

[ Parent | on HN ]

Re:PSA: Upgrade your LUKS key derivation function by mjg59 on Tuesday April 18, 2023 @10:43PM (#35623653)

If you can dump the contents of memory then you have the key (after all, the CPU has to be able to encrypt and decrypt the material, so it has to be available).

[ Parent | on HN ]

Re:PSA: Upgrade your LUKS key derivation function by zamnos on Tuesday April 18, 2023 @10:52PM (#35623718)

Pedantically, if there's an HSM/similar hardware in play, the CPU only asks for material to be encrypted/decrypted and doesn't have the key in system RAM to be able to do so itself.

MacOS machines with a T2 chip keep the encryption key in the T2 chip so it isn't in system RAM.

[ Parent | on HN ]

Re:PSA: Upgrade your LUKS key derivation function by ryan-c on Wednesday April 19, 2023 @03:11AM (#35625232)

Apparently it's possible to keep the key in the debug registers: https://en.wikipedia.org/wiki/TRESOR

[ Parent | on HN ]

Re:PSA: Upgrade your LUKS key derivation function by zamnos on Tuesday April 18, 2023 @10:47PM (#35623686)

If the DRAM is powered on at the time of seizure, recovering the key is eminently possible. If this is an issue for you, completely power off the laptop when transiting customs.

https://en.wikipedia.org/wiki/Cold_boot_attack

[ Parent | on HN ]