In a way it'd actually be great if police was frequently cracking encrypted communications of old algorithms. It'd both increase the pressure on better standards as well as remove the need for shitty laws banning encryption outright.
WTF is a KDF?
41–50 of 98 posts
Re: WTF is a KDF?
#42What I find weird is that not many talk about one of the parameter to PBKDF2, c , the number of iterations desired. Someone here mentioned it a few days ago: just make decryption fast enough to be acceptable for you but still a big multiplier compared to the default. What do people care, when unlocking their SSD, if it takes 3ms or 300ms to unlock the SSD at boot? I mean: attacker shall have a bazillion RAM and a tri…
The linked ElcomSoft article claims that LUKS does does that sort of thing by default:
>LUKS varies the number of hash iterations used to protect the master encryption key. When creating an encrypted disk with a given combination of encryption settings, LUKS benchmarks the user’s system. The data is used to select the number of hash iterations protecting the master encryption key.
Re: WTF is a KDF?
#4310.000 cloud GPUs running for a month is a lot of money. What was on that hard drive?
Governments are formidable adversaries to have. They have amongst other virtually unlimited funds and resources.
An average police department, however, has very limited funds. Unless the guy is much more interesting that we know, nobody would spend that much money on cracking his address book.
Re: WTF is a KDF?
#44An interesting bit from the linked ElcomSoft article:
>Brute force attacks became not just faster, but much smarter as well. The user’s existing passwords are an excellent starting point. These passwords can be pulled from the user’s Google Account, macOS, iOS or iCloud keychain, Microsoft Account, or simply extracted from the user’s computer. The user’s existing passwords give a hint at what character groups are likely used:
So if the victim used portions of that "longer than 20 characters" password in their other passwords, the amount of work required to crack the LUKS password would be much reduced.
Re: WTF is a KDF?
#45Earlier quoted context omitted.
Well, we also know they didn't crack a random 20 character password. But some people appear to be panicking as if they did.
You know this because you think it is mathematically impossible?
Not mathematically, but physically. You need astronomical quantities of energy. Bruce Schneier pointed this out in "Applied Cryptography" (1996):
https://www.schneier.com/blog/archives/2009/09/the_doghouse_... (unfortunately the exponents are not displayed correctly here)
> One of the consequences of the second law of thermodynamics is that a certain amount of energy is necessary to represent information. To record a single bit by changing the state of a system requires an amount of energy no less than kT, where T is the absolute temperature of the system and k is the Boltzman constant. (Stick with me; the physics lesson is almost over.)
>Given that k = 1.38×10-16 erg/°Kelvin, and that the ambient temperature of the universe is 3.2°Kelvin, an ideal computer running at 3.2°K would consume 4.4×10-16 ergs every time it set or cleared a bit. To run a computer any colder than the cosmic background radiation would require extra energy to run a heat pump.
>Now, the annual energy output of our sun is about 1.21×1041 ergs. This is enough to power about 2.7×1056 single bit changes on our ideal computer; enough state changes to put a 187-bit counter through all its values. If we built a Dyson sphere around the sun and captured all its energy for 32 years, without any loss, we could power a computer to count up to 2192. Of course, it wouldn’t have the energy left over to perform any useful calculations with this counter.
>But that’s just one star, and a measly one at that. A typical supernova releases something like 1051 ergs. (About a hundred times as much energy would be released in the form of neutrinos, but let them go for now.) If all of this energy could be channeled into a single orgy of computation, a 219-bit counter could be cycled through all of its states.
>These numbers have nothing to do with the technology of the devices; they are the maximums that thermodynamics will allow. And they strongly imply that brute-force attacks against 256-bit keys will be infeasible until computers are built from something other than matter and occupy something other than space.
Re: WTF is a KDF?
#46Compared to Windows+Bitlocker, using full disk encryption on Ubuntu (the most user friendly distro) is bizarrely difficult. By default the boot partition is not encrypted (so evil maid attacks are easier) and the KDF iteration counts are way too low, as can be seen here. When I setup FDE with LUKS on my Ubuntu laptop I had to go the manual route since I noticed that the default iteration counts don't make any sense,…
TL;DR: secure boot is hard, TPM security is a challenge.
FDE works fine with encrypted boot, it's just not the default for Ubuntu. I just ticked the "encrypt my install" box as far as I know, I only found out that my /boot wasn't encrypted after the fact.
For evil maid attacks, encrypting /boot or not shouldn't really matter unless there's a known exploit for your bootloader. IMO it doesn't matter much because before you can decrypt the main drive, you'll have to deal with either a rewriteable boot sector, a rewriteable EFI:/boot/grub, or a rewriteable /boot. Each step should verify the hashes of the next loader and of any of the loaded modules, so an attacker would need to inject themselves into your boot process before the verification chain can start. You need to keep secure boot on, though.
Setting this up right involves enrolling keys into your UEFI (every time the bootloader updates), securing your UEFI with a good password, and assuring nobody can reflash your motherboard firmware somehow. All of that isn't necessary if you trust that Microsoft's keys don't leak and if you use the pre-signed shims, but that approach tends to break kernel modules (i.e. when you use Nvidia's driver).
Microsoft can get around this problem because their root keys are preloaded into almost every secure boot capable device you can find. They can pre-sign a bootloader and distribute it to hundreds of millions of computers, whereas every Linux distro has to jump through hoops and use the Microsoft-signed loader as an inbetween stage or have the user set up their own keys and signature system.
Then there's the challenge of TPMs. Windows uses the TPM to verify nothing has changed or demand a recovery key, and can use TPM+PIN to unlock a Bitlocker partition. On Linux, there is a wide variety of tools, but as far as I can tell, you can only choose between "unlock the disk from the TPM" or "unlock the disk with your passphrase". I suppose it's possible to set up a multi stage boot process in which initramfs is loaded from a TPM-based key and the main system is decrypted using a password, but I'm not aware of any easy to use installers for that purpose. I find proper GUI support for TPM configuration sorely lacking compared to other operating systems.
The iteration count LUKS defaults to depends on your CPU's performance. By default, LUKS takes 1000ms (or 2000ms in modern versions) of hashing to determine the amount of iterations. I can definitely see why, because at some point I put my iterations up to 10 seconds and the preboot environment, lacking the necessary acceleration instructions, took forever to unlock the disk. Anyone trying out encryption on their new install would probably wipe and retry without encryption with those parameters, which is obviously worse.
Getting secure boot set up right is the biggest challenge in my experience. The tools are all there, but there's no real GUI for configuring any of this and with how many Linux enthusiasts will decree that secure boot is Microsoft conspiracy and TPMs are instruments of the devil, I'm not sure that'll change any time soon.
Re: WTF is a KDF?
#47"An activist imprisoned in France" makes this sound like some sort of locked up protestor, rather than someone that set fire to a load of vehicles and a warehouse.
It should really read "An arsonist imprisoned in France".
Re: WTF is a KDF?
#48The use of a memory hard KDF like Argon2 is hardly a panacea for something like disk encryption. If your passphrase is compute time hard already, the advantage of using something memory hard is unlikely to be more than a factor of a thousand or so. Adding even a single diceware generated word to a passphrase increases the difficulty by a factor of 7776. So passphrase length is by far the dominant factor.
There is a faction out there that claims that Argon2 is not as good as cache hard functions for the case where the user is only going to be willing to wait second or less. That's a reasonable assumption so it would probably be a good idea to evaluate more than just Argon2 for any particular application. Yes I know that Argon2 won a contest, but such contests are followed by a much longer evaluation period.
Re: WTF is a KDF?
#49This isn't a PBKDF2 problem. It's a password problem with roots in practicality and psychology. His password has absolutely not been 20 random characters, but instead something easy to remember and type in, quite likely just 3 or 4 common words.
Pbkdf2 is designed to protect the users from their own bad choices more than anything else.
In fact if you think about it, pbkdf2 with a high number of iterations could become quite costly at scale. How much are you willing to pay to protect a given user from themselves?
If someone uses a proper password, one iteration is all you need.
Re: WTF is a KDF?
#50"An activist imprisoned in France" makes this sound like some sort of locked up protestor, rather than someone that set fire to a load of vehicles and a warehouse. It should really read "An arsonist imprisoned in France".
Those aren't mutually exclusive. France isn't known for having neutered nonviolent protests like those in the US and UK.