Talk:LVM on LUKS

Why was ,mode=1777 removed from /tmp? --Ncopa (talk) 07:12, 15 May 2014 (UTC)

---

Hello! While following the directions for installing grub (via grub-install) I found the package efibootmgr is longer available using apk. Help! --Mnemolyst (talk) 22:40, 07 Nov 2019 (UTC)

---

The last two umount statements before the reboot require a newer version of umount than what comes in the standard Alpine download. I needed to add the package util-linux to get the correct version and although the page mentions the package in the early section about getting the boot device name it doesn't explicitly state to download it. --Sadbadman (talk) 06:45, 2 February 2020 (UTC)

---

I had difficulty with an encrypted /boot setup sda1=>efi, sda2=>crypt=>lvm(/root,/boot,swap). The instructions by default will result in using LUKS2 with Argon2. This is not actually supported by GRUB2 for an encrypted /boot setup (see Arch wiki article "GRUB", section "Encrypted_/boot" and GRUB bug 55093 - i can't post links yet). Until GRUB 2.06 is released and reaches alpine, users wanting encrypted /boot may need --type luks1 when running cryptsetup luksFormat. And once GRUB 2.06 does arrive, it may require using PBKDF2. Users will need to consult GRUB documentation when that time comes. --Stapleemptier (talk) 09:09, 16 February 2020 (UTC)

I was able to confirm the above about --type luks1 today. That, plus adding "GRUB_ENABLE_CRYPTODISK=y" to /etc/default/grub, allowed this procedure to work with v3.11. I will update accordingly. --Stapleemptier (talk) 00:38, 17 February 2020 (UTC)

Optional: Overwrite LUKS Partition with Random Data

Is this section still accurate since since Kernel 5.6, or roughly Alpine Linux version 3.13? Doesn't /dev/random now do what is needed here without installing extra packages? zcrayfish (talk) 18:56, 17 December 2021 (UTC)

 Done

Looks like psykose, et al, removed the references to mostly obsolete haveged.

zcrayfish (talk) 03:23, 14 August 2023 (UTC)

Optimized for security suggestions lowers the memory cost for attacks

The currently suggested optimized for security in cryptsetup recommendations lowers the memory cost for attacks from the defaults. From the article:

[..] you could either use the default settings (aes-xts-plain64 cipher with 256-bit key and Argon2 hashing with iter-time 2000ms), or you could use these settings which have added security with the trade-off being a non-noticeable decrease in performance on modern computers:

Luks2 Optimized for security:

# cryptsetup -v -c aes-xts-plain64 -s 512 --hash sha512 --pbkdf pbkdf2 --iter-time 5000 --use-random luksFormat /dev/sda2

The defaults in cryptsetup were changed from pbkdf2 to Argon2id exactly for this reason: To make it more memory costly in order to inhibit usage of gpus/asics in attacks. We recommend the exact opposite of what the maintainers of cryptsetup did. The compute power of GPUs have increased significantly more than those of CPUs as such I think to add memory cost to the attackers is valuable goal.

See also 10.4 from the cryptsetup FAQ

10.4  Why use Argon2 in LUKS 2 instead of PBKDF2?

LUKS tries to be secure with not-so-good passwords.  Bad passwords need to
be protected in some way against an attacker that just tries all possible
combinations.  (For good passwords, you can just wait for the attacker to
die of old age...) The situation with LUKS is not quite the same as with a
password stored in a database, but there are similarities.
LUKS does not store passwords on disk.  Instead, the passwords are used to
decrypt the volume-key with it and that one is stored on disk in encrypted
form.  If you have a good password, with, say, more than 80 bits of
entropy, you could just put the password through a single crypto-hash (to
turn it into something that can be used as a key) and that would be secure.
This is what plain dm-crypt does.
If the password has lower entropy, you want to make this process cost some
effort, so that each try takes time and resources and slows the attacker
down.  LUKS1 uses PBKDF2 for that, adding an iteration count and a salt.
The iteration count is per default set to that it takes 1 second per try on
the CPU of the device where the respective passphrase was set.  The salt is
there to prevent precomputation.
The problem with that is that if you use a graphics card, you can massively
speed up these computations as PBKDF2 needs very little memory to compute
it.  A graphics card is (grossly simplified) a mass of small CPUs with some
small very fast local memory per CPU and a large slow memory (the 4/6/8 GB
a current card may have).  If you can keep a computation in the small,
CPU-local memory, you can gain a speed factor of 1000 or more when trying
passwords with PBKDF2.
Argon2 was created to address this problem.  It adds a "large memory
property" where computing the result with less memory than the memory
parameter requires is massively (exponentially) slowed down.  That means,
if you set, for example, 4GB of memory, computing Argon2 on a graphics card
with around 100kB of memory per "CPU" makes no sense at all because it is
far too slow.  An attacker has hence to use real CPUs and furthermore is
limited by main memory bandwidth.
Hence the large amount of memory used is a security feature and should not
be turned off or reduced.  If you really (!) understand what you are doing
and can assure good passwords, you can either go back to PBKDF2 or set a
low amount of memory used for Argon2 when creating the header.

--Johanneszab (talk) 11:38, 31 May 2024 (UTC)