FASSAG Wiki

LUKS/Advanced: Difference between revisions

← Older edit

CRYSTL (talk | contribs)

4 user groups
89 edits
VisualWikitext
reworked this page
clarify the entropy and remove the "online debate" aspect
 
(2 intermediate revisions by the same user not shown)
Line 49: Line 49:
  <code>argon2i       4 iterations, 735656 memory, 4 parallel threads (CPUs) for 256-bit key (requested 2000 ms time)</code>
  <code>argon2i       4 iterations, 735656 memory, 4 parallel threads (CPUs) for 256-bit key (requested 2000 ms time)</code>
  <code>argon2id      4 iterations, 842046 memory, 4 parallel threads (CPUs) for 256-bit key (requested 2000 ms time)</code>
  <code>argon2id      4 iterations, 842046 memory, 4 parallel threads (CPUs) for 256-bit key (requested 2000 ms time)</code>
  <code>    Algorithm |       Key |      Encryption |      Decryption</code>[[entropy]]
  <code>    Algorithm |       Key |      Encryption |      Decryption</code>
  <code>      aes-cbc        128b       594.1 MiB/s      1434.3 MiB/s</code>
  <code>      aes-cbc        128b       594.1 MiB/s      1434.3 MiB/s</code>
  <code>  serpent-cbc        128b        59.8 MiB/s       371.1 MiB/s</code>
  <code>  serpent-cbc        128b        59.8 MiB/s       371.1 MiB/s</code>
Line 65: Line 65:


== [[Entropy]] ==
== [[Entropy]] ==
Though unlikely, to avoid an [[Entropy Starvation|entropy starved]] situation, you can use <code>--use-random</code> when setting up the disk.
Though unlikely, to mitigate an [[Entropy Starvation|entropy starved]] situation, you can use <code>--use-random</code> when setting up the disk. This tells cryptsetup to draw randomness from <code>/dev/random</code> instead of <code>/dev/urandom</code>. Simply put, the only difference between <code>/dev/random</code> and <code>/dev/urandom</code> is that <code>/dev/random</code> will wait until the kernel detects enough entropy has been gathered. If you are seriously worried about entropy starvation though, this may not be enough.
 
There's a lot of debate and conflicting information online about the difference between <code>/dev/random</code> and <code>/dev/urandom</code> online. The main difference is that <code>/dev/random</code> will wait until it detects enough entropy has been gathered. Since it only affects when you initially setup the disk though, waiting for it to gather enough entropy is generally a good idea. Whether its method of ensuring it has gathered enough data is effective, is also somewhat debated, but it certainly doesn't hurt.


An easy way to ensure you have enough entropy, is to gather it from an external source. For example, you can run: <code>curl -Ss <nowiki>https://www.random.org/cgi-bin/randbyte?nbytes=16384&format=f</nowiki> > /dev/random</code>. This command gathers random bytes from [https://random.org random.org]. Using an external source like this is ok, since Linux has ways to gather entropy besides this that an attacker would not be able to replicate.
An easy way to ensure you have enough entropy, is to gather it from an external source. For example, you can run: <code>curl -Ss <nowiki>https://www.random.org/cgi-bin/randbyte?nbytes=16384&format=f</nowiki> > /dev/random</code>. This command gathers random bytes from [https://random.org random.org]. Using an external source like this is ok, since Linux has ways to gather entropy besides this that an attacker would not be able to replicate.
== Disk Setup ==
Assuming you know what partition you want to use, setting up the disk is as simple as:
<code>cryptsetup luksFormat --type luks2 --cipher aes-xts-plain64 --hash sha256 --iter-time 2000 --key-size 256 --pbkdf argon2id --use-random --verify-passphrase /dev/YOURPARTITIONHERE</code>
As mentioned previously, these settings are the default on the latest cryptsetup (with the exception of <code>--use-random</code>). Setting them manually ensures that they are correct on older versions. You can check what the defaults are for your system by running <code>cryptsetup --help</code>. You can then verify that it was setup correctly with:
<code>cryptsetup luksDump /dev/YOURPARTITIONHERE</code>
Once it has been setup, it can be opened with:
<code>cryptsetup open /dev/YOURPARTITIONHERE dm_name</code>
Note that "dm_name" can be set to whatever you like, and the disk will be available at:
<code>/dev/mapper/dm_name</code>
Then you will need to format it, via something like:
<code>mkfs.ext4 /dev/mapper/dm_name</code>
Retrieved from "https://wiki.fassag.dev/index.php/LUKS/Advanced"