3 ms·

You can also simply have LUKS with a detached header - I know some people that have their header and boot partitions exclusively on a USB, so that it's required

by chc4 6y ago

You can also simply have LUKS with a detached header - I know some people that have their header and boot partitions exclusively on a USB, so that it's required to be in possession of the USB key to unlock and boot your computer.

comboy 6y ago
Be careful with that solution, you then have to have a separate backup strategy for that USB data.
- OJFord 6y ago
  Only if the computer has important (and not backed up/replicated) state.
- xwdv 6y ago
  Throw it in an S3 bucket. Done.
- dkdk8283 6y ago
  Exactly, and that backup strategy is likely to be the weak link.
notfed 6y ago
I called this out in the PUREE paper: > To be fair, some tools do support support completely-random-looking disk layouts, but in most cases, they either: > 1. Are key-based (e.g., require a 128-bit or 256-bit key) rather than password based, in which case, the key must stored elsewhere. (Where do you store the key?) > 2. Ask the user to store a (non-random-looking) disk-encryption header elsewhere (i.e., “detached header mode”). (Where do you store the header?)
- tempay 6y ago
  > 1. Are key-based (e.g., require a 128-bit or 256-bit key) rather than password based, in which case, the key must stored elsewhere. (Where do you store the key?) Is there a reason why this is notably different? Why can't the password be hashed to get the fixed length key?
  - viraptor 6y ago
    Yes, it's a pretty standard approach. I can't even recall anything that uses passwords directly these days. Mostly due to world relying mainly on aes where you have to derive the key.
- jcynix 6y ago
  > 2. Ask the user to store a (non-random-looking) disk-encryption header elsewhere (i.e., “detached header mode”). (Where do you store the header?) If the header isn't needed on a daily basis, storing it as a QR-Code on paper would be a possibility.

3 ms·

You can also simply have LUKS with a detached header - I know some people that have their header and boot partitions exclusively on a USB, so that it's required

by chc4 6y ago

comboy 6y ago
Be careful with that solution, you then have to have a separate backup strategy for that USB data.
- OJFord 6y ago
  Only if the computer has important (and not backed up/replicated) state.
- xwdv 6y ago
  Throw it in an S3 bucket. Done.
- dkdk8283 6y ago
  Exactly, and that backup strategy is likely to be the weak link.
notfed 6y ago
I called this out in the PUREE paper: > To be fair, some tools do support support completely-random-looking disk layouts, but in most cases, they either: > 1. Are key-based (e.g., require a 128-bit or 256-bit key) rather than password based, in which case, the key must stored elsewhere. (Where do you store the key?) > 2. Ask the user to store a (non-random-looking) disk-encryption header elsewhere (i.e., “detached header mode”). (Where do you store the header?)
- tempay 6y ago
  > 1. Are key-based (e.g., require a 128-bit or 256-bit key) rather than password based, in which case, the key must stored elsewhere. (Where do you store the key?) Is there a reason why this is notably different? Why can't the password be hashed to get the fixed length key?
  - viraptor 6y ago
    Yes, it's a pretty standard approach. I can't even recall anything that uses passwords directly these days. Mostly due to world relying mainly on aes where you have to derive the key.
- jcynix 6y ago
  > 2. Ask the user to store a (non-random-looking) disk-encryption header elsewhere (i.e., “detached header mode”). (Where do you store the header?) If the header isn't needed on a daily basis, storing it as a QR-Code on paper would be a possibility.