Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I recently installed 11.10 on a fresh disk using entire disk encryption. Can someone tell me how secure the encryption algorithm is? Has there been any recent breaches with said algorithm? I use a 36 character random passphrase so I know thats not a weak link. What are the chances my client's data could be compromised if the hard drive was stolen?

share|improve this question
    
You might be better off asking how long it would (on average) take someone to break that passphrase. Also it might help to know if the person stealing it would know it has credit card data for example. I think you can argue that if it isn't credit cards no one is going to brute force it -- no money in it. –  jcollum Jan 20 '12 at 20:46
3  
Secure against what ? Cracking the encryption with a super computer - difficult but not impossible. Cracking the code with a $10 wrench - easier imgs.xkcd.com/comics/security.png –  bodhi.zazen Jan 20 '12 at 21:17
    
Here's how to see which cipher you're using in LUKS: What is used in the 12.10 full disk encryption? –  gertvdijk Jan 21 '13 at 10:17

3 Answers 3

up vote 6 down vote accepted

Yes, it is secure. Ubuntu uses AES-256 to encrypt the disk volume and has a cypher feedback to help protect it from frequency attacks and others attacks that target statically encrypted data.

As an algorithm, AES is secure and this has been proved by crypt-analysis testing. The weakness actually lies within the cypher and the software to pass it the keys. Specifically lies in the keystore (which is stored in the header of the volume), the keystore is secured by a passphrase. Passphrases are of course open to some attacks such as dictionary/brute force (if this was successful, it would decrypt the keystore). Using long "complex" non-word passwords would reduce the chance of this happening.

The only other possibility to decrypt is using recording devices or social engineering to determine your passphrase.

In short, your computer is reasonably safe unless you are subject to serious organised cyber crime or Government investigation!

share|improve this answer
3  
You should however note that if your computer is taken whilst running or in suspend mode (hibernation is fine), there are various, fairly easy techniques to extract the password from RAM. I would thusly advice caution on which state you leave your laptop in whilst traveling, but overall you should be safe from most potential scenarios of data loss. –  ternaryOperator Jan 21 '12 at 5:39

I have created a Windows program that will perform a dictionary attack on Luks volumes. http://code.google.com/p/luks-volume-cracker/

Its slow by design, trying around 3 keys a second. Other dictionary attacks will be similarly slow, so unless you've chosen an easy passphrase the weakness will not be the algorithm.

Be aware of key stealing from memory, and caching of files, however.

share|improve this answer
    
This does not answer the question how secure it is. This is an answer to a question on how do I perform a dictionary attack on my LUKS device?. –  gertvdijk Feb 6 '13 at 15:30
1  
@gertvdijk I think this may answer the question. "unless you've chosen an easy passphrase the weakness will not be the algorithm." The rest could be considered a demonstration of that principle. The last sentence is on-topic too. –  Eliah Kagan Feb 6 '13 at 16:17
    
@EliahKagan I disagree. The question is explicitly about the algorithm itself. Just stating "the weakness will not be the algorithm" is not an answer to that, in my believe. Don't get me wrong - it still has valid and valuable points, but not for this question. –  gertvdijk Feb 6 '13 at 16:28
    
@gertvdijk This answer also gauges how long it takes to crack the algorithm, with a link to a demonstration. I'm not saying this is the best answer, but I think it falls on the side of being an answer (to this question). Furthermore, how secure the algorithm is, is actually just one of several parts of the question. –  Eliah Kagan Feb 6 '13 at 16:42
    
I do think this goes some way to demonstrate the level of possible attack against LUKS. 3 attempts a second from a dictionary is never going to crack a semi-decent passphrase. –  Oli Jan 3 at 16:56

Here are two resources about attacks on this type of file system that seem to be interesting from a google search. http://dx.eng.uiowa.edu/dave/luks.php http://www.jakoblell.com/blog/2013/12/22/practical-malleability-attack-against-cbc-encrypted-luks-partitions/

share|improve this answer
1  
Welcome to Ask Ubuntu! Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference. –  guntbert Jun 9 at 10:07

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.