4 ms·
Could luks have been designed to use memory-hard hash funcrions to prevent brute forcing like this?
by badrabbit 7y ago
Could luks have been designed to use memory-hard hash funcrions to prevent brute forcing like this?
- aaronmdjones 7y agoLUKS2 (the current version) does support Argon2 with up to 4 GiB of memory and 4 threads.
- loeg 7y agoPer the article, LUKS is designed to use 2 seconds of PBKDF2 iterations, which is going to be vastly greater than the 2016 NIST recommended minimum of 10,000 iterations. So brute forcing is already quite slow, although not as memory hard as newer KDFs like scrypt/argon. It's not a bad design for 2004. As the sibling commenter and article point out, LUKS2 defaults to argon2i with 2 seconds of iteration time and 1GB of memory, 4 threads.
- mrb 7y agoActually LUKS uses 1 second of iterations, last time I checked, and according to the code: https://gitlab.com/cryptsetup/cryptsetup/blob/master/lib/libcryptsetup.h#L323 https://gitlab.com/cryptsetup/cryptsetup/blob/master/lib/lib...
- loeg 7y agoNope. That's a comment on a tangentially related function declaration; it happens to be inaccurate. Here is where the default is actually specified (2000 ms): https://gitlab.com/cryptsetup/cryptsetup/blob/master/configure.ac#L579 https://gitlab.com/cryptsetup/cryptsetup/blob/master/configu... CS_NUM_WITH([luks1-iter-time], [PBKDF2 iteration time for LUKS1 (in ms)], [2000]) See also https://gitlab.com/cryptsetup/cryptsetup/blob/master/lib/utils_pbkdf.c#L27 https://gitlab.com/cryptsetup/cryptsetup/blob/master/lib/uti... . const struct crypt_pbkdf_type default_pbkdf2 = { .type = CRYPT_KDF_PBKDF2, .hash = DEFAULT_LUKS1_HASH, .time_ms = DEFAULT_LUKS1_ITER_TIME };