4 ms·

The creator of LUKS has a few words around this on Reddit. This appears to be a non-story unless you're not practicing best proper password management Clemens

The creator of LUKS has a few words around this on Reddit. This appears to be a non-story unless you're not practicing best proper password management Clemens Fruhwirth here. I am the inventor of LUKS. A random keyboard typable character gives you around 6 bits of entropy. 20 of those give you 120 bits of entropy. Even without a KDF, brute-forcing this key space is infeasible with today's hardware. Even with PBKDF2, a 13-character password should be enough to keep your data secure for your lifetime.[1] It is much more likely that there was some security failure in the linked case other than PBKDF2. That said, I support the upgrade to Argon2. [1] In my thesis on LUKS, Chapter 5.3 Passwords from entropy weak sources anticipates the creation of specialized hardware for breaking PBKDF2. The "13 characters should be enough" advice is found on Page 86, Table 5.4, top left cell. It gives a 78-bit recommendation (=13 characters) in the worst-case scenario, which is Moore's law continues to double the attacker speed every 2 years. [0]https://www.reddit.com/r/linux/comments/12q51ce/psa_upgrade_your_luks_key_derivation_function/jgpvsqc/ https://www.reddit.com/r/linux/comments/12q51ce/psa_upgrade_...

blueflow 4y ago
How do you even get a "Social Justice Warrior" badge on reddit?
- steelbrain 4y ago
  In most subreddits, you can choose your own flair through reddit preferences. Once logged in, on `old.reddit.com`, search for "Show my flair on this subreddit. It looks like:" on the right side of the screen.
8organicbits 4y ago
I always find this thinking fascinating. If you are using a suitably strong password, you don't need a KDF. And you _should_ be using a strong password, so we can hand wave any KDF related issues away. But people don't use strong passwords. We should know this by now. End users pick weak, predictable, non-random, short passwords. I've seen IT departments (who should know better) set weak passwords for users like "Company2023". A KDF can't save you if your password is extremely weak, but it can improve a mediocre password such that an attacker will give up before they succeed.
- CodesInChaos 4y ago
  Even when using a very strong password, you should still use a KDF, since many ciphers expect uniformly random keys. But it could be a cheap unsalted one instead of an expensive salted hash.
- deleted 4y ago
  [deleted]
- pmontra 4y ago
  I really don't get that. I see it happening even in companies that use password managers. Some silly easy passwords and they don't even have to type them, they should copy and paste them from the password manager. I use it to generate random passwords and I can't understand why not everyone is doing it.
woodruffw 4y ago
I think the creator's comment is talking past the original post: in my reading, it wasn't suggested that a random 20-character password was successfully brute-forced due to a weak KDF. My reading was that the target likely had a strong non-random password, one that was derivable via OSINT or post-seizure forensics (i.e., playing password keyword soup). The KDF's weakness made a search for that password feasible where a strong KDF (like Argon2id) would have prevented it. In other words: nothing about the scenario requires the target to have failed to engage in proper password management or even password selection (beyond the minor but extremely normal decision to use a memorable password rather than a random one).
- GoblinSlayer 4y ago
  Something like correct horse battery staple can be guessed on first try, no KDF will save you then.
  - ravi-delia 4y ago
    And 128 characters chosen by quantum decay in an airgapped facility would be unassailable. But among the many passwords between the two, there is a band of passwords which were reasonably secure under a threat model that excluded massive GPU attacks, and are not reasonably secure when one includes them.
    - azalemeth 4y ago
      Something I have wondered about as a nerdy person is just typing in your favourite bit of maths (as LaTeX) or similarly pseudocode. Utterly memorable to you, highly unlikely to be memorable to other people, high use of special characters and non-English words, and a reasonable number of characters are generated without brain power. A bad example of this perhaps would be "i\hbar\frac{∂}{∂t}|\psi\rangle=H|\psi\rangle". Burned into my brain, typable quickly on a keyboard with known special character locations (replace ∂ with \partial if that is a concern) and almost _certainly_ not in a wordlist. Shannon entropy of ~4.3, equivalent to ~240 bits of key, and a specific metric entropy of ~0.1.
atoav 4y ago
Not sure here, but hasn't argon2 some advantages beyond simple brute-force-resistance? (e.g. that it can be made to scale with hardware or better resistance to timing attacks)?
- Freaky 4y ago
  Its main benefit is it's memory-hard in addition to time-hard. You're not just repeating a hash function across a few dozen bytes a few thousand times, you're doing it over tens or hundreds of MB, thus making it much harder to scale up an attack.

blueflow 4y ago

How do you even get a "Social Justice Warrior" badge on reddit?

steelbrain 4y ago
In most subreddits, you can choose your own flair through reddit preferences. Once logged in, on `old.reddit.com`, search for "Show my flair on this subreddit. It looks like:" on the right side of the screen.

8organicbits 4y ago

I always find this thinking fascinating. If you are using a suitably strong password, you don't need a KDF. And you _should_ be using a strong password, so we can hand wave any KDF related issues away. But people don't use strong passwords. We should know this by now. End users pick weak, predictable, non-random, short passwords. I've seen IT departments (who should know better) set weak passwords for users like "Company2023". A KDF can't save you if your password is extremely weak, but it can improve a mediocre password such that an attacker will give up before they succeed.

CodesInChaos 4y ago
Even when using a very strong password, you should still use a KDF, since many ciphers expect uniformly random keys. But it could be a cheap unsalted one instead of an expensive salted hash.
deleted 4y ago
[deleted]
pmontra 4y ago
I really don't get that. I see it happening even in companies that use password managers. Some silly easy passwords and they don't even have to type them, they should copy and paste them from the password manager. I use it to generate random passwords and I can't understand why not everyone is doing it.

woodruffw 4y ago

I think the creator's comment is talking past the original post: in my reading, it wasn't suggested that a random 20-character password was successfully brute-forced due to a weak KDF. My reading was that the target likely had a strong non-random password, one that was derivable via OSINT or post-seizure forensics (i.e., playing password keyword soup). The KDF's weakness made a search for that password feasible where a strong KDF (like Argon2id) would have prevented it. In other words: nothing about the scenario requires the target to have failed to engage in proper password management or even password selection (beyond the minor but extremely normal decision to use a memorable password rather than a random one).

GoblinSlayer 4y ago
Something like correct horse battery staple can be guessed on first try, no KDF will save you then.
- ravi-delia 4y ago
  And 128 characters chosen by quantum decay in an airgapped facility would be unassailable. But among the many passwords between the two, there is a band of passwords which were reasonably secure under a threat model that excluded massive GPU attacks, and are not reasonably secure when one includes them.
  - azalemeth 4y ago
    Something I have wondered about as a nerdy person is just typing in your favourite bit of maths (as LaTeX) or similarly pseudocode. Utterly memorable to you, highly unlikely to be memorable to other people, high use of special characters and non-English words, and a reasonable number of characters are generated without brain power. A bad example of this perhaps would be "i\hbar\frac{∂}{∂t}|\psi\rangle=H|\psi\rangle". Burned into my brain, typable quickly on a keyboard with known special character locations (replace ∂ with \partial if that is a concern) and almost _certainly_ not in a wordlist. Shannon entropy of ~4.3, equivalent to ~240 bits of key, and a specific metric entropy of ~0.1.

atoav 4y ago

Not sure here, but hasn't argon2 some advantages beyond simple brute-force-resistance? (e.g. that it can be made to scale with hardware or better resistance to timing attacks)?

Freaky 4y ago
Its main benefit is it's memory-hard in addition to time-hard. You're not just repeating a hash function across a few dozen bytes a few thousand times, you're doing it over tens or hundreds of MB, thus making it much harder to scale up an attack.