[dm-crypt] Question regarding LUKS
arno at wagner.name
Thu Oct 20 13:02:00 CEST 2011
On Thu, Oct 20, 2011 at 10:43:54AM +0200, Milan Broz wrote:
> On 10/20/2011 10:18 AM, Arno Wagner wrote:
> > I don't think anybody ever invested the money needed
> > to find out.
> Well, maybe you noticed some changes in dmcrypt and even
> cryptsetup which were directly closely related
> to this problem.
Relax. I basically said the same thing as you, just that
AFAIK nobody applied for a certification (which costs money).
And the only way to really find out is to invest that money
and apply for certification.
> AFAIK FIPS 140-2 is always related to some hw config,
> but in principle (and if you define cryptographic boundaries
> properly) dm-crypt and LUKS have no serious issues here.
It seems a leve-1 certification can be gotten for software
but this example is the rare (only?) example.
> The main problem is proper RNG and crypto use (you have
> to use only approved RNG and only certified crypto library),
> and it cannot be isolated from the kernel certification etc.
> So there are no principal problems I know about but
> still some changes are needed (some of them are really
> dm-crypt mailing list
> dm-crypt at saout.de
Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email: arno at wagner.name
GnuPG: ID: 1E25338F FP: 0C30 5782 9D93 F785 E79C 0296 797F 6B50 1E25 338F
Cuddly UI's are the manifestation of wishful thinking. -- Dylan Evans
If it's in the news, don't worry about it. The very definition of
"news" is "something that hardly ever happens." -- Bruce Schneier
More information about the dm-crypt