LUKS volumes have the ability to allow multiple independently usable passwords, as explained here: [https://code.google.com/p/cryptsetup/wiki/FrequentlyAskedQuestions]

The intuition behind basic encryption with a single key is pretty straightforward.

ciphertext = BIG_FUNCTION(plaintext, key)
plaintext = BIG_FUNCTION^(-1)(ciphertext, key)

Can anyone explain how a LUKS volume can permit independently usable passwords? I'm just looking for the intuition - not necessarily a detailed explanation of how LUKS in particular handles this.


Roughly your password is used to encrypt a MasterSecretKey. Then you use this MasterSecretKey with a symmetric algorithm to encrypt or decrypt your data (the disk sectors). They eight key slots in LUKS are eight different encryptions of the same MasterSecretKey under eight different passwords.

See also this image: http://auto0.info/linux/2005/61/065-071_encrypt/images/fig3-partition-header_s.png (original web page: http://auto0.info/secret-messages-download-red-hat-fedora) (original image http://nnc3.com/LM10/Magazine/Archive/2005/61/065-071_encrypt/images/fig3-partition-header.png is not more available)

Actually LUKS does not encrypt the MasterSecretKey with a password but with a key, generated with a PBKDF.

A similar approach is used by GPG when you send a message to a set of distinct recipients.

This is usally know as KEM/DEM paradigm: Key Encapsulation Method/Data Encapsulation Method and it is the standard method when you use public key to encrypt something.

  • $\begingroup$ Thank you, that's very clear. Does that have any negative impact on security, other than the obvious practical one that a brute-force attacker is up to (say) 8x more likely to guess a valid password? $\endgroup$ – SauceCode Feb 19 '15 at 20:15
  • $\begingroup$ Nope. Under the hypothesis that the encryption scheme used to encrypt the MasterSecretKey is secure. A standard encryption scheme does not leak any information about the plaintext if it is encrypted under multiple and different keys. $\endgroup$ – ddddavidee Feb 19 '15 at 20:18
  • $\begingroup$ Actually in general some related keys attacks exists but it is very unlikely for this context. $\endgroup$ – ddddavidee Feb 20 '15 at 7:15
  • $\begingroup$ Anything you could point me toward, out of curiosity? $\endgroup$ – SauceCode Feb 20 '15 at 13:35
  • $\begingroup$ @SauceCode How about wikipedia: related-key attacks and related-key attacks on AES. $\endgroup$ – tylo Aug 4 '15 at 11:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.