[dm-crypt] No key available for this passphrase
arno at wagner.name
Tue Jan 29 03:39:11 CET 2013
On Mon, Jan 28, 2013 at 06:46:53PM -0500, .. ink .. wrote:
> > but a function like this or any other
> > mechanism of header-protection would be nice to see as standard for LUKS.
> > Especially because the first keyslot is so likely to be corrupted by
> > partition
> > managers (should be aroud the offset of keyslot 0 where they start to dump
> > their
> > data?).
> has there been any study to find out which ones of the keyslots is most
> likely to get corrupted accidentally by various tools?
I do not think there is enough data. And there is the additional
problem that corruption in others than slot 0 will not be noticed
by most users. You are welcome to search the mai,ing-list archives
and generate a statistic, of course.
> will adding keys from the last slot going backwards add some protection
> from keys being inaccessible due to accidental header corruption by various
I think most tools will kill the header. After that, damage to
key-slots does not matter much, as the header carries the all-iportant
salts. While it does happen occasionally that just a key-slot gets
corrupted, it is rare. The keyslot-checker I wrote was not due to
a dire need, but because I hacked together a version in Python that
read the disk directly in a 2-3 hours, and then Milan (rightfully)
asked me to do it right. Provided entertainment for me for a
weekend and an opportunity to look at libcryptsetup. I think we
may have seen someting like 5-6 cases altogether in the last few
years. No idea how many people managed to kill their LUKS containers,
but never reported it on the list.
And anyways, disks do die, so data-backup is mandatory even for
encrypted volumes. See the FAQ for some suggestions.
Arno Wagner, Dr. sc. techn., Dipl. Inform., Email: arno at wagner.name
GnuPG: ID: CB5D9718 FP: 12D6 C03B 1B30 33BB 13CF B774 E35C 5FA1 CB5D 9718
One of the painful things about our time is that those who feel certainty
are stupid, and those with any imagination and understanding are filled
with doubt and indecision. -- Bertrand Russell
More information about the dm-crypt