277 reputation
19
bio website xavierm02.net
location France
age 21
visits member for 2 years, 1 month
seen 1 hour ago

French. Loves JavaScript.


Aug
12
accepted Force installation of doc packages
Aug
11
asked Force installation of doc packages
Jul
2
awarded  Curious
Jun
21
awarded  Caucus
May
10
comment Running several times the same command with several aguments after a pipe
@Gilles : I asked a new question there: crypto.stackexchange.com/questions/16109/…
May
10
revised Running several times the same command with several aguments after a pipe
added 73 characters in body
May
10
revised XOR of a shell variable and a binary file
added 73 characters in body
May
9
comment Running several times the same command with several aguments after a pipe
I want to protect all data at rest with a password and a keyfile and be able to back up the keyfile using secret sharing. This implies that I can't encrypt the keyfile with the password because otherwise, I would have to replace all the backups everytime I changed the password. The only other way to require both is to derive a key from both (atm using xor). And I have any tools I want available since I can just add hooks to make update-initramfs add things to the ramfs. Aside from the derivation method, there is no real choice, unless I want to mess with dm-crypt directly, and I don't.
May
9
comment Running several times the same command with several aguments after a pipe
What's the reason for using print -rn instead of echo -n? And do I really need to do $(get_key) instead of get_key?
May
9
comment Running several times the same command with several aguments after a pipe
(it=cryptsetp). About the memory, I still don't understand. The password is in memory and I XOR it but reading the file character per character and outputing the result as soon as it's ready. Imagine a 10GB keyfile. I will never have it all in memory but will still be able to compute the xor since it needs just one character at a time. Anyway, not having it in memory isn't a requirement. It's just something that might improve security.
May
9
comment Running several times the same command with several aguments after a pipe
I don't get why the entropy of the password needs to be spread. The fact that the keyfile is random makes the output random, whether you know the password, just how it looks or nothing about it. Think of it that way: It would be secure if I gave it just the password. But I want to require the keyfile too so I XOR the password with the keyfile. The entropy of the result is strictly larger than the entropy of the password alone. There could be a problem is it sliced the password and used different parts of it for different things but it doesn't: it uses a key derivation function on it.
May
9
comment Running several times the same command with several aguments after a pipe
The key file feature only allows a keyfile, not a key file and a password so I have to produce a keyfile that depends on my keyfile and the password anyway. That's what I'm doing but I have it read the file from stdin. | I'm thinking of trying to switch to your way of doing it because otherwise, making a "change password" thing is really annoying: prompting when you have pipes everywhere and background processes is a bit hard.
May
9
comment Running several times the same command with several aguments after a pipe
The keyfile is quite long. The C program reads a character from the keyfile, one from stdin and then outputs the xor of those two chars. It doesn't keep it in memory. It might stay a bit longer because of the output buffer but then it gets transferred to cryptsetup. And I don't think the buffer is big enough to retain the whole key. | Why is it not a good way? If you concatenate them, your resulting key has a regognizable pattern: random stuff followed by human-readable characters. If you xor them, you have no information on the resulting key.
May
9
accepted Running several times the same command with several aguments after a pipe
May
9
comment Running several times the same command with several aguments after a pipe
The keyfile is obvously on a usb key that doesn't remain near the computer obviously. Worst case senario: cryptsetup waits for the whole key and this way of doing it is as secure as yours. Best case senario: it doesn't and the key is never all in memory and the places where it is placed is then used for the rest of it so recovering the whole key from memory is impossible.
May
9
comment Running several times the same command with several aguments after a pipe
It's not. get_key asks for a password, calls a C program (xor) with via stdin (but the password is in memory). The C program returns the xor of the key and the keyfile it reads (and I don't think he even has all the keyfile in memory). Which is piped to cryptsetup. In short decrypt device means promt_password | xor keyfile | cryptsetup luksOpen -d - device. I don't think it will ever be all in memory, or at least not in the part of the process I control.
May
9
comment Running several times the same command with several aguments after a pipe
get_key prompts for a password so he won't get anything. And I'm not trying to protect data from someone having a virus on my computer or access to it while it's on. I'm trying to protect it from someone who would try to recover the data from the computer while off. And that someone wouldn't care what permissions your file has or where it was written. I did not know about that feature of ksh so thank you for that. But I still like the idea of never having the whole key written linearly in memory so I'll do it Joseph's way. +1 though :)
May
9
comment Running several times the same command with several aguments after a pipe
I will :) I'm just making sure it works first. And since the program isn't as simple as I made it look, it's taking time :)
May
8
comment Running several times the same command with several aguments after a pipe
It does, thank you :)
May
8
comment Running several times the same command with several aguments after a pipe
You're writing the keys to several files. I want to use the key to decrypt several files..