TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Decryption through LUKS2 reencryption crash recovery

143 点作者 beermonster超过 3 年前

9 条评论

formerly_proven超过 3 年前
Generally speaking hard drive encryption protects against theft and not tampering. I.e. the idea is that if your laptop or NAS is &quot;lost and found&quot;, then you wipe the drive and restore from backup, not continue to use the drive.<p>-<p>Since the protocol used here is broken the fix is to change the protocol - so keep in mind that...<p>&gt; The former reencryption operation (without the additional digest) is no longer supported (reencryption with the digest is not backward compatible). <i>You need to finish in-progress reencryption before updating to new packages.</i> The alternative approach is to perform a repair command from the updated package to recalculate reencryption digest and fix metadata.<p>Just in case you were thinking about upgrading the software during re-encryption - don&#x27;t.
评论 #30108022 未加载
评论 #30108790 未加载
chopin超过 3 年前
What&#x27;s still unclear to me: can you just grab an encrypted device (cold) and decrypt it? Or does the attack require a &quot;live&quot; device i.e one where the passphrase already have been given and the device is online?
评论 #30102085 未加载
评论 #30102160 未加载
评论 #30101976 未加载
评论 #30102766 未加载
评论 #30107630 未加载
josephcsible超过 3 年前
What does this let an attacker do exactly that they couldn&#x27;t already do with a regular evil maid attack?
评论 #30102103 未加载
评论 #30102352 未加载
Aardwolf超过 3 年前
&gt; LUKS2 online reencryption is an optional extension to allow a user to change the data reencryption key while the data device is available for use during the whole reencryption process.<p>Since it&#x27;s optional, is it possible to see if this is enabled or disabled, and how to disable it?
akeck超过 3 年前
Some people keep the LUKS2 volume header in a separate file that&#x27;s encrypted (e.g., with gpg). Would someone still be able to attack a cold volume using this vulnerability in that case?
lvass超过 3 年前
I still don&#x27;t get how the fix works. If I just mount an external LUKS2 device in an updated system, It&#x27;s good to go?
评论 #30102284 未加载
gray_-_wolf超过 3 年前
&gt; The attack is not applicable to LUKS1 format, but the attacker can update metadata in place to LUKS2 format as an additional step.<p>First time I&#x27;m glad grub cannot boot LUKS2.
评论 #30108623 未加载
aborsy超过 3 年前
Could then NSA crack any LUKS encrypted container held on cloud storage such as Dropbox or GDrive (opened with a key on client side, never entered on server)?
评论 #30103506 未加载
FeistySkink超过 3 年前
Does this affect LUKS1?
评论 #30101759 未加载