this post was submitted on 23 Jun 2023
17 points (100.0% liked)

Linux

1823 readers
1 users here now

Everything about Linux

RULES

founded 1 year ago
MODERATORS
Fryboyter@discuss.tchncs.de
17
PSA: Upgrade your LUKS PBKDF to Argon2id! (tails.boum.org)
submitted 1 year ago by maltfield@lemmy.ca to c/linux@discuss.tchncs.de
6 comments fedilink hide all child comments
 

TIL the French government may have broken encryption on a LUKS-encrypted laptop with a "greater than 20 character" password in April 2023.

When upgrading TAILS today, I saw their announcement changing LUKS from PBKDF2 to Argon2id.

The release announcement above has some interesting back-of-the-envelope calculations for the wall-time required to crack a master key from a LUKS keyslot with PBKDF2 vs Argon2id.

And they also link to Matthew Garrett's article, which describes how to manually upgrade your (non-TAILS) LUKS header to Argon2id.

you are viewing a single comment's thread
view the rest of the comments
[–] maltfield@lemmy.ca 3 points 1 year ago (1 children)

LUKS is not broken. An old KDF option in LUKS for encrypting the master encryption key in a keyslot is just old and less safe than newer, better KDF options.

[–] dko1905@discuss.tchncs.de 7 points 1 year ago (2 children)

The article is almost 70 days old, and Clemens Fruhwirth, one of the creators of LUKS, has responded:

A random keyboard typable character gives you around 6 bits of entropy. 20 of those give you 120 bits of entropy. Even without a KDF, brute-forcing this key space is infeasible with today's hardware. Even with PBKDF2, a 13-character password should be enough to keep your data secure for your lifetime.[1]

It is much more likely that there was some security failure in the linked case other than PBKDF2. That said, I support the upgrade to Argon2.

[1] In my thesis on LUKS, Chapter 5.3 Passwords from entropy weak sources anticipates the creation of specialized hardware for breaking PBKDF2. The "13 characters should be enough" advice is found on Page 86, Table 5.4, top left cell. It gives a 78-bit recommendation (=13 characters) in the worst-case scenario, which is Moore's law continues to double the attacker speed every 2 years.

It doesn't seem like it's such a big deal.

[–] Eufalconimorph@discuss.tchncs.de 2 points 1 year ago

Yep, a 10 Diceware word passphrase is just as secure as a 128-bit encryption key, even if only HKDF were used instead of a password-based KDF. Key stretching matters when you have weak passphrases, and even Argon2 only adds a few bits of effective entropy with reasonable difficulty factors.