From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from pigeon.gentoo.org ([208.92.234.80] helo=lists.gentoo.org) by finch.gentoo.org with esmtp (Exim 4.60) (envelope-from ) id 1OES0T-0000iM-1e for garchives@archives.gentoo.org; Tue, 18 May 2010 18:59:09 +0000 Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id C9D74E083D; Tue, 18 May 2010 18:58:02 +0000 (UTC) Received: from zion.lichtfels.com (zion.lichtfels.com [88.198.33.170]) by pigeon.gentoo.org (Postfix) with ESMTP id 771A2E083D for ; Tue, 18 May 2010 18:58:02 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by zion.lichtfels.com (Postfix) with ESMTP id CCEF1184019; Tue, 18 May 2010 20:58:01 +0200 (CEST) Received: from zion.lichtfels.com ([127.0.0.1]) by localhost (zion [127.0.0.1]) (amavisd-maia, port 10024) with LMTP id 19162-02; Tue, 18 May 2010 20:57:59 +0200 (CEST) Received: from [172.32.99.12] (mail.oops.co.at [213.129.238.225]) by zion.lichtfels.com (Postfix) with ESMTPA id DED90184006; Tue, 18 May 2010 20:57:58 +0200 (CEST) Message-ID: <4BF2E336.8030106@xunil.at> Date: Tue, 18 May 2010 20:57:58 +0200 From: "Stefan G. Weichinger" Organization: oops! User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1.9) Gecko/20100410 Lightning/1.0b2pre Thunderbird/3.0.4 Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-user@lists.gentoo.org Reply-to: gentoo-user@lists.gentoo.org MIME-Version: 1.0 To: Jan Engelhardt CC: gentoo-user@lists.gentoo.org, Daniel Troeder , walt , Florian Philipp , Jason Dusek , Till Maas , hanno@gentoo.org Subject: [gentoo-user] Re: Kernel upgrade and now LUKS failure References: <4BF108F3.1080304@xunil.at> <4BF299B4.2040306@xunil.at> <4BF2C6A7.6040607@xunil.at> In-Reply-To: X-Enigmail-Version: 1.0.1 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit X-Virus-Scanned: amavisd-maia at lichtfels.com X-Archives-Salt: 555094ea-5750-4ab9-b305-49e6ad35aaef X-Archives-Hash: 53c51bda4a8eda6b9bfbf2e9bc0f3923 Am 18.05.2010 19:57, schrieb Jan Engelhardt: >> But given the fact that I store the key on the same hard-disk with the >> shadowed user-pw I could also leave that openssl-part straight away, >> correct?? seems the same level of (in)security to me ... > > Yes. The point of keyfiles is to be able to change the password on > a volume. > > Without a keyfile, a crypto program would take the password, hash it > somehow, and you get your AES key. Changing the password means having > a different AES key, meaning decrypting the disk will yield a > different result. In other words, changing the password would require > at least reading the old data, reencrypting it and writing it again. > Takes time. > > With a keyfile, you retain the same AES key all the time, and encrypt > the AES key itself - reencrypting the AES key is quick, as it's > only some xyz bits, not terabytes. Ok, I see. So my current setup with one disk only and SSL-generated keyfile does not add security but flexibility (being able to switch passwords more quickly). Do you see a way of getting this working with my current packages: pam_mount-2.1 sys-fs/cryptsetup-1.1.1_rc2 and LUKS ... ? As mentioned the old keyfile works with pam_mount-1.33, when I check the changelog at http://sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/sys-auth/pam_mount/ChangeLog?view=markup this is a package from 10 Jan 2010, so maybe it wouldn't be too risky to just mask >pam_mount-1.33 - On the other hand I would like to get that done right, sure. Any howto without pmt-ehd that would keep me safe from newlines etc (btw. there were NO newlines in that hexdump-output)? Thanks for your time, Stefan