what are the security benefits of LUKS?

Question

Aremed with only basic crypto knowledge, I'm trying to understand the security benefits of LUKS over plain-mode dm-crypt. Hopefully this is a good place to ask.

Given the LUKS header contains information describing how the payload is encrypted, would it not be more secure to use plain dm-crypt instead?

I'm thinking that a plain device will just look like random data and won't have a label attached that tells all that it's encrypted data and what the cipher and other details are. Plain mode allows plausible deniability where as LUKS doesn't.

The LUKS header not only contains the master key (albeit it stretched and encrypted) but it also contains up to eight attack vectors that can be used to get the master key. Yet, underlying all this, the same dm-crypt engine is used to encrypt both the plain and luks payloads.

Therefore, attacking a plain or luks payload could be done directly (however impractical that may be), but LUKS throws in some additional ways to crack the data whereas plain-mode gives nothing away.

I guess it may boil down to the fact that a user of plain mode will need to have the actual key and may not store it securely or use a pass-phrase that is only hashed simplistically, whereas a user of LUKS mode will never have the actual key but will use a pass-phrase that is put through a salted iterative key derivation function.

So, is LUKS less secure than plain dm-crypt ?

Answer 1

I think it is often considered a principle in evaluating the quality of a cryptographic setup to start with the assumption that the opponent is aware of the algorithm and the only variable unknown is the key. Given this, there are not many cryptographically motivated security benefits/differences, given you use the same cipher (+ block chaining mode of operation).

Arguably for the human eye, the LUKS header gives away information to the attacker and it feels wrong to do so. I expect we are misled in thinking that because of the perceived amount of information about the specifics of the encryption it is a human emotion to feel bad since one whole point of encryption is to avoid giving away information in the first place.

Yet by using dm-crypt directly I fear most of what is achieved is some additional security through obscurity, something many people are rather skeptical about. Maybe this is because its effect can hardly be estimated. To some extent for instance you might be coerced into using a safe encryption scheme either way and since such a trusted cipher (block-chaining-mode+) does not exist in that great abundance, chances are high that you will use AES 256 CBC or alike. If you were to use some other cipher you maybe might gain potentially some better protection against cryptanalysis that attempts to abuse AES specific weak points. On the other side, not using AES for this inestimable safety might lead you to a cipher XXX that is not as tested and hardened against standard cryptoanalytic attacks.

After all in bullet-point style (things to consider):

• LUKS header will defeat much plausible deniability, while dm-crypt pseudo-random hard drive "better" (this is of course not a cryptographic attribute, and would more be focused on http://security.stackexchange.com )
• LUKS will use some random data source (I think it is /dev/random even) to create the master key for encrypting the hard drive/partition, which might be considered more entropic than a key derived from a passphrase (if that was the way you provide dm-crypt with a key).
• Then again, LUKS will generate key slots that use key derivation functions to accept keys for unlocking the master key.

Consider also that security is a context-dependent concept. For instance, it can be said a LUKS setup is more secure as it protects you from losing the encryption master key since after all it is stored (again encrypted) in the LUKS header. You still can lose access to your data by way of forgetting the passphrase.

Also, LUKS gives some security to lose the information about which cipher was used, as it is directly stored in the header, while that would be something that you need to secure your dm-setup against (you need to remember what you did).