0

I noticed that the application called gnome-disks which is the disk manager in many distros under the gnome and other desktops, gives you the option to encrypt a partition with LUKS.

It only offers LUKS1, which was developed in 2004. Isn't there a newer version to that or something stronger, I doubt personally that something so old is still strong. Isn't there a LUKS2 for example or a software with stronger encryption of partitions?

Improve this question
2
  • 4
    kernel.org/pub/linux/utils/cryptsetup/LUKS_docs/… clearly states 2016, so obviously the LUKS v1 spec receives updates. "I doubt personally that something so old is still strong" plenty of cryptographical algorithms and techniques are old. RSA was published in 1977, so will you stop using it?
    – muru
    Oct 17, 2017 at 2:40
  • @muru yes but RSA has different key sizes and while the 1024 bit key size might have been good back in the 70's, by now a 4096 is suggested. I am not sure how the LUKS system handles key sizes.
    – Averagejoe2322
    Oct 31, 2017 at 16:24

1 Answer 1

Reset to default
7

First good encryption is hard, and not something for us mere mortals to roll our selves. Linux Unifed Key Setup aka LUKS started as a way to standardize encryption key setup.

In on-disk-format.pdf states "The LUKS design can be used with any cipher or cipher mode." So as needs have changed ciphers can be changed.

Use Something Stronger?

from cryptsetup wiki FrequentlyAskedQuestions - Security Aspects.

Passphrase entropy  Cost to break
50 bit              EUR/USD   600k
55 bit              EUR/USD    20M
60 bit              EUR/USD   600M
65 bit              EUR/USD    20B
70 bit              EUR/USD   600B
75 bit              EUR/USD    20T

Why not use LUKS2?

LUKS2 does not yet have a fixed API. See release notes for Cryptsetup 2.0.0 RC0.

From the release notse:

Release candidate with experimental features.

This version introduces a new on-disk LUKS2 format.

The legacy LUKS (referenced as LUKS1) will be fully supported forever as well as a traditional and fully backward compatible format.

NOTE: This version changes soname of libcryptsetup library and increases major version for all public symbols. Most of the old functions are fully backward compatible, so onlyrecompilation of programs should be needed.

Please note that authenticated disk encryption, noncryptographicdata integrity protection (dm-integrity), use of Argon2 >Password-Based Key Derivation Function and the LUKS2 on-disk format >itself are new features and can contain some bugs. Please do not use it without properly configured backup or in production systems.

Until final 2.0 version is released, the new API calls or LUKS2 format could still change if a major problem is found.

Improve this answer
3
  • Note that 2.0.0 is still a RC (release candidate). It's not a released version yet.
    – muru
    Oct 17, 2017 at 4:59
  • As of now, it appears LUKS2 is now stable? If so, this is technically an outdated answer. I also used gnome-disk-utility 3.36.1 with UDisks 2.8.4 (built against 2.8.4) and noticed the same issue.
    – J.W.F.
    Jun 15, 2020 at 18:18
  • As of cryptsetup v2.1.0 Luks2 is the default for new volumes. See cryptsetup v2.1.0 release notes. @JWF thank you for reminding my of this answer. If you would like to research and improve my answer simply submit an edit or your own answer. Other wise I will look into an update.
    – J. Starnes
    Jun 15, 2020 at 18:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.