3 ms·

Note that this requires using dm-crypt in plain mode, which allows only one passphrase, doesn't perform any passphrase mangling or salting, and performs no pass

Note that this requires using dm-crypt in plain mode, which allows only one passphrase, doesn't perform any passphrase mangling or salting, and performs no passphrase checking on decryption. It requires one to re-enter exact parameters, and an improper passphrase will happily give bunk data. Secondly, high-entropy data is evident at even a courtesy glance - normal computer and filesystem operations do not produce high-entropy data on disk, therefore a large portion of high-entropy disk data is highly suspect. The author discusses this in detail in sections 2.4 and 5.2 of https://gitlab.com/cryptsetup/cryptsetup/wikis/FrequentlyAskedQuestions https://gitlab.com/cryptsetup/cryptsetup/wikis/FrequentlyAsk...

yholio 8y ago
True, but the default parameters of cryptsetup are quite secure with a high entropy password and they are seldom changed. A volume opened with the wrong password will fail to mount with no ill effects, you would just crypysetup delete and then re-create it again with the right password. I've addressed at length the other issues above, initializing an encrypted drive with random data is a widely recommended countermeasure against attacks that exploit the way the filesystem allocates sectors, VeraCrypt does it by default and many graphical setups for Linux offer the option for encrypted drives.