Aremed with only basic crypto knowledge, I'm trying to understand the security benefits of LUKS over plain-mode dm-crypt. Hopefully this is a good place to ask.

Given the LUKS header contains information describing how the payload is encrypted, would it not be more secure to use plain dm-crypt instead?

I'm thinking that a plain device will just look like random data and won't have a label attached that tells all that it's encrypted data and what the cipher and other details are. Plain mode allows plausible deniability where as LUKS doesn't.

The LUKS header not only contains the master key (albeit it stretched and encrypted) but it also contains up to eight attack vectors that can be used to get the master key. Yet, underlying all this, the same dm-crypt engine is used to encrypt both the plain and luks payloads.

Therefore, attacking a plain or luks payload could be done directly (however impractical that may be), but LUKS throws in some additional ways to crack the data whereas plain-mode gives nothing away.

I guess it may boil down to the fact that a user of plain mode will need to have the actual key and may not store it securely or use a pass-phrase that is only hashed simplistically, whereas a user of LUKS mode will never have the actual key but will use a pass-phrase that is put through a salted iterative key derivation function.

So, is LUKS less secure than plain dm-crypt ?


I think it is often considered a principle in evaluating the quality of a cryptographic setup to start with the assumption that the opponent is aware of the allgorithm and the only variable unknown is the key. Given this there are not many cryptographicly motivated security benefits/difference, give you use the same cipher (+ block chaining mode of operation).

Arguably for the human eye the LUKS header gives away information to the attacker and it feels wrong to do so. I expect we are mislead in thinking that because of the perceived amount of information about the specifics of the encryption it is a human emotion to feel bad, since one whole point of encryption is to avoid giving away information in the first place.

Yet by using dm-crypt directly I fear most of what is achieved some additional security through obscurity, something many people are rather sceptical about. Maybe this is because its effect can hardly be estimated. To some extend for instance you might be coerced into using a safe encryption scheme either way and since such a trusted ciphers (block-chaining-mode+) do not exists in that great abundance chances are high that you will use AES 256 CBC or alike. If you were to use somet other cipher you maybe might gain potentially some better protection against cryptoanalysis that attempts to abuse AES specific weak points. On the other side not using AES might for this inestimable safety might lead you to a cipher XXX which is not as tested and hardened against standard cryptoanalytic attacks.

After all in bullet point style (things to consider)

  • LUKS header will defeat much plausible deniability, while dm-crypt pseudo-random harddrive "better" (this is of course not a cryptographic attribute, and would more be focused on http://security.stackexchange.com )
  • LUKS will use some random data source (I think it is /dev/random even) to create the master key for encrypting the harddrive/partition, which might be considered more entropic than a key derived from a password (if that was the way you provide dm-crypt with a key).
  • Then again LUKS will generate keyslots which use key derivation functions so to accept keys for unlocking the master key.

Consider also that security is a context-dependent concept. For instance it can be said a LUKS setup is more secure as it protects you of loosing the encryption master key, since after all it is stored (again encrypted) in the LUKS header. You still can loose - by way of forgeting the password - access to it.
Also LUKS gives some security to loose the information about which cihper was used, as it is directly stored in the header, while that would be something that you need to secure your dm-setup against (you need to remember what you did).

  • $\begingroup$ The point about a user-created key being less entropic is very relevant. Another key difference is the fact that plain dm-crypt does nothing special (beyond hashing) to pass phrases. Contrast with LUKS which applies PBKDF2 and further processes the encrypted key with an anti-forensic "splitter" which bloats the amount of encrypted data that is stored in the header, thus making key attack via the header more difficult. $\endgroup$ – starfry Nov 20 '14 at 10:40
  • $\begingroup$ @starfry all very valid points. Yet a setup using dm-crypt or else to directly encrypt a block device might not necessarily be missing any similar improvements. when really talking about pro/cons of either setup one would need to be more specific. Simply to decide to go withou LUKS must not mean that some safety measures are not adopted just as well hence making both having the same relative strength (yet having plausible deniability on the dm-setup). $\endgroup$ – humanityANDpeace Nov 21 '14 at 7:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.