From owner-freebsd-geom@FreeBSD.ORG Wed Feb 8 22:47:11 2006 Return-Path: X-Original-To: freebsd-geom@freebsd.org Delivered-To: freebsd-geom@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 9362916A420 for ; Wed, 8 Feb 2006 22:47:11 +0000 (GMT) (envelope-from pjd@garage.freebsd.pl) Received: from mail.garage.freebsd.pl (arm132.internetdsl.tpnet.pl [83.17.198.132]) by mx1.FreeBSD.org (Postfix) with ESMTP id E332143D46 for ; Wed, 8 Feb 2006 22:47:10 +0000 (GMT) (envelope-from pjd@garage.freebsd.pl) Received: by mail.garage.freebsd.pl (Postfix, from userid 65534) id BD1BF50B87; Wed, 8 Feb 2006 23:47:08 +0100 (CET) Received: from localhost (dkq125.neoplus.adsl.tpnet.pl [83.24.20.125]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.garage.freebsd.pl (Postfix) with ESMTP id DF47250A16; Wed, 8 Feb 2006 23:47:00 +0100 (CET) Date: Wed, 8 Feb 2006 23:46:45 +0100 From: Pawel Jakub Dawidek To: Christian Baer Message-ID: <20060208224645.GF732@garage.freebsd.pl> References: <20060208201852.GA732@garage.freebsd.pl> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="3yNHWXBV/QO9xKNm" Content-Disposition: inline In-Reply-To: X-PGP-Key-URL: http://people.freebsd.org/~pjd/pjd.asc X-OS: FreeBSD 7.0-CURRENT i386 User-Agent: mutt-ng/devel-r535 (FreeBSD) X-Spam-Checker-Version: SpamAssassin 3.0.4 (2005-06-05) on mail.garage.freebsd.pl X-Spam-Level: X-Spam-Status: No, score=-0.5 required=3.0 tests=BAYES_00,RCVD_IN_NJABL_DUL, RCVD_IN_SORBS_DUL autolearn=no version=3.0.4 Cc: freebsd-geom@freebsd.org Subject: Re: -p with GELI X-BeenThere: freebsd-geom@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: GEOM-specific discussions and implementations List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 08 Feb 2006 22:47:11 -0000 --3yNHWXBV/QO9xKNm Content-Type: text/plain; charset=iso-8859-2 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Wed, Feb 08, 2006 at 10:51:09PM +0100, Christian Baer wrote: +> On Wed, 8 Feb 2006 21:18:53 +0100 Pawel Jakub Dawidek wrote: +> > What you want to use is '-k' option. +> > If you really know what you're doing you can do something like this: +>=20 +> Hmm, I thought the keyfile and the passphrase were treated differently. +> Does that mean they are exchangeable, i.e. if I init the provider with a +> passphrase I can attach it with a keyfile of the same content as the +> passphrase? No, but you may pass 'keyfile' through standard input, so it can be anything. You must know, that for keyfiles PKCS#5v2 won't be used nor additional salt. +> > I suggest not to use the same passphrase for all providers. +> > You can always do something like: +> > +> > pass_da0=3D3D`echo "0${passphrase}0" | sha256` +> > pass_da1=3D3D`echo "1${passphrase}1" | sha256` +> > pass_da2=3D3D`echo "2${passphrase}2" | sha256` +>=20 +> For that to be of any real good[1], the script would have to be on an +> encrypted provider - preferably with a *completely* different passphrase +> (and as a result a completely different key) itself. But if the attacker +> can analyse this script, then a brute forcing the ${passphrase} will gra= nt +> access to all providers. +>=20 +> Or am I missing the point here completely? This is not to prevent brute force attack, it's just better no to use the same key. Actually here it is not so important as it is only used for Master-Key encryption which is random. Anyway, in my opnion this is the list from the safest to the most unsafe configuration list: 1. Different passphrase for every provider. 2. Different key for every provider derived from the same passphrase. 3. One passphrase for every provider. --=20 Pawel Jakub Dawidek http://www.wheel.pl pjd@FreeBSD.org http://www.FreeBSD.org FreeBSD committer Am I Evil? Yes, I Am! --3yNHWXBV/QO9xKNm Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2 (FreeBSD) iD8DBQFD6nTVForvXbEpPzQRAmZ/AKCXqcPhQV5hFgwSiRanlZT+BrWh/QCfQk33 eg9VydgnJ+S3OBuQCr/Aw/0= =bBz2 -----END PGP SIGNATURE----- --3yNHWXBV/QO9xKNm--