6

Suppose I want an Ubuntu setup (let it be 12.04) with full disk encryption. Ubuntu offers this as an option during installation.

Suppose also that I have somebody (e.g. my vendor) else set this up for me and that I only get the finished system including the predefined encryption password (and of course all other passwords).

Is there any way that this person can reliably retain access to the encrypted data on the device even when I change the encryption password (and possibly other passwords)?

(Note that I'm not talking about normal backdoors like installing a SSH key or a root shell or patching some daemon to receive commands from outside. I am talking specifically about backdoors that target the full disk encryption and possibly cannot be closed without having to reinstall or re-encrypt the whole system.)

For example, with TrueCrypt it is (or was) possible to save the first sectors of an encrypted harddisk, because it only uses the password to encrypt the master key (which is then used to encrypt the data) - and if you replace both password and encrypted master key by replacing those sectors after a password change, you can practically undo an encryption password change.

Is something like this possible with dm-crypt/LUKS? If not, anything similar?

8

Yes, of course. The vendor can just keep the master key. A backup of the LUKS header. As this key never changes even as you change the password, it allows full access to all the data. So you are entirely depending on trust here. Backdoors and everything else just come on top of that.

In addition to the manpage, the Cryptsetup FAQ is a good read:

http://code.google.com/p/cryptsetup/wiki/FrequentlyAskedQuestions

It covers all sorts of loopholes. Your question is answered there as well in 6.7 Does a backup compromise security?

I'm not a vendor, but in that case I would consider keeping a backup of the master key a service. If I sell to non-computer-savvy people, they may forget their passwords, and come to me for help. And having the master key is the only way to help in such a case, short of bruteforcing LUKS which is only possible if you can narrow it down to a few million possibilities (i.e. if you more or less know your passphrase but do not know which variant exactly you used). Of course if you do this you should be honest about it.

If you want to be able to trust a system, you always have to set it up by yourself. This includes image install services in data centers and all other sorts of things.

  • Thank you. You confirmed what I already suspected. I could also have asked, "if I trust neither Microsoft's nor Apple's disk encryption, would using Linux with dm-crypt be any better even if I cannot set it up myself". I guess the answer is no. – Jens Sep 7 '13 at 19:01
  • @Jens right, and considering latest revelations of the actions of some government agencies, you could take it as far as saying you cannot trust any hardware that you don't build yourself (which unfortunately includes making the CPU and all the other circuitry). :/ – peterph Oct 3 '13 at 9:28
  • True. But one has to be realistic. Any encryption which is more expensive to crack than an opponent with a $5 wrench and an attitude is probably worthless - given a sufficiently determined opponent. So, before thinking too much about encryption details, you have to decide what exactly you are afraid of. xkcd.com/538 I personally just don't want my data (emails, bank passwords, family photos, ...) accessible to $RANDOM_NOTEBOOK_THIEF. – Jens Oct 4 '13 at 10:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.