A running computer has two LUKS volumes that were made with the same password. One volume is open (key is in RAM), the other is closed.

If the running computer is stolen, is the closed volume safe?

If sha256 is broken, is the closed volume safe?


It should be safe. If the running computer is stolen and memory is read, it's the master key that will be revealed, allowing decryption of only that volume. The password itself is only used transiently when you open the volume to decrypt the master key. The other volume, despite using the same password to decrypt its constituent master key, will have a different master key.

When you use a system like LUKS, you are not encrypting data directly with your password. Rather, a completely random key is generated that is used to encrypt your data. This key is called the master key, sometimes called a data encryption key. This master key is itself encrypted with another key (derived from your password), called the slot key, or key encryption key. The encrypted master key is then stored directly in the encrypted volume. Because each volume will use a different master key, revealing one master key says nothing about the other, nor does it say anything about your password.

An attacker can attempt to brute force your password. This is done by guessing a password, processing it, and seeing if it can successfully decrypt the master key. They will only succeed if your password is very weak due to the processing algorithm LUKS uses, called PBKDF2. This algorithm runs your password through a hash function a huge number of times. It is intended to take approximately one second on a consumer computer. While waiting one second to see if your password is correct won't bother the end-user, it does mean that cracking the password becomes significantly harder.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.