My understanding is that dm-crypt serves to abstract the actual block device so that the read/decrypt and write/encrypt happen automatically.

However, assuming a device mapping with target: crypt is created, it has a file system, and it is already mounted, is it possible to tell dm-crypt to ask for the key on every write (encryption) and read (decryption) instead of automatically using the key present in the table mapping?

What I'm really asking here is can we extend FDE to also have security at run-time and not just when the computer is off or the hard drive is stolen? Or is FBE the only appropriate method for such things?

  • In my opinion: "No". But you could get a [slim usb key] (discountmugs.com/product-images/detail/…), with the connector w/o an outer shell, so that it slides out easier than the standard. Then get a ring for your left pinky finger, and tie ~10cm of string between the two. Then configure you computer to shut down, when you remove the "USB security device" from the laptop side port with a quick flick of the wrist. Then you just need them to kick down your door, and you'll be Ready™ to shutdown your computer fast ;) – Alex Stragies Apr 21 '17 at 0:09

In principle, it'd be possible to have dm-crypt "forget" the key and require it to be retyped every time, but it'd be impractical and very inconvenient. Reads and writes to the filesystem don't necessarily correspond directly to user operations like "open a file" or "save a file".

  • When a program opens a file, it doesn't necessarily load the whole thing into RAM all at once. It might keep the file open and just read parts of it as needed, interrupting you with password prompts at arbitrary times.
  • Likewise, when a program writes to a file, it doesn't necessarily write the whole thing at once. And even if it does, write caching can delay the actual write to disk.
  • Depending on what software is on your system, there may be things that need to access the filesystem in the background, independent of whatever you're doing (and possibly when you're away from the computer). This would lead to more random interruptions with password prompts.

In practice, you can't do what you want because dm-crypt doesn't support it, since it's impractical for the above reasons.

| improve this answer | |

If I'm reading you correctly and you're proposing that the key is constantly changing during runtime, then a huge 'map' of key history would need to be kept in order to go back and access data that was written n keys ago. Either that, or if the key change results in the disk drive being 're-imaged' every time the key changes you'd need some kind of seriously fast drive to achieve that.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.