[dm-crypt] Question regarding LUKS

Arno Wagner arno at wagner.name
Thu Oct 20 13:02:00 CEST 2011


On Thu, Oct 20, 2011 at 10:43:54AM +0200, Milan Broz wrote:
> On 10/20/2011 10:18 AM, Arno Wagner wrote:
> > I don't think anybody ever invested the money needed
> > to find out. 
> 
> Well, maybe you noticed some changes in dmcrypt and even
> cryptsetup which were directly closely related
> to this problem.

Relax. I basically said the same thing as you, just that
AFAIK nobody applied for a certification (which costs money).
And the only way to really find out is to invest that money 
and apply for certification. 

> AFAIK FIPS 140-2 is always related to some hw config,
> but in principle (and if you define cryptographic boundaries
> properly) dm-crypt and LUKS have no serious issues here.

It seems a leve-1 certification can be gotten for software
only, http://www.openssl.org/docs/fips/fipsnotes.html,
but this example is the rare (only?) example.
 
Arno

> The main problem is proper RNG and crypto use (you have
> to use only approved RNG and only certified crypto library),
> and it cannot be isolated from the kernel certification etc.
> 
> So there are no principal problems I know about but
> still some changes are needed (some of them are really
> formal).
> 
> Milan
> _______________________________________________
> dm-crypt mailing list
> dm-crypt at saout.de
> http://www.saout.de/mailman/listinfo/dm-crypt
> 

-- 
Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email: arno at wagner.name 
GnuPG:  ID: 1E25338F  FP: 0C30 5782 9D93 F785 E79C  0296 797F 6B50 1E25 338F
----
Cuddly UI's are the manifestation of wishful thinking. -- Dylan Evans

If it's in the news, don't worry about it.  The very definition of 
"news" is "something that hardly ever happens." -- Bruce Schneier 


More information about the dm-crypt mailing list