Re: [gentoo-user] Encripting /home

[Pupeno]

On Thursday 28 July 2005 02:54, Richard Fish wrote:
> Pupeno wrote:
> >>I use the dm-crypt from the kernel....
> >
> >I've read that it is unsecure and I also read that it is not yet vory well
> >suported.
>
> Dm-crypt is fairly well supported, since it is in the kernel, but I find
> it to be harder to setup and less 'flexible' than loop-AES (the changing
> passphrase thing, for example).

I know it is in the kernes, but I've read that there weren't good userland 
tool to work with dm-crypt. Maybe that has changed and Gentoo's userland 
tools can work with dm-crypt, what's the status of that ?
Regarding loop-AES I've read it needs some heavy patching here and there, I 
don't want to do any patching myself because I am likely to loose track of 
it.

> It provides rougly the equivalent security as loop-AES in "single-key"
> mode (where a single key is used to encrypt every block).  loop-AES also
> supports multi-key mode, where 64 different keys are used to encrypt the
> blocks.  Multi-key makes certain kinds of attacks (specifically,
> watermark) more difficult, but is slower.
>
> However, I seem to recall reading somewhere in the last couple of weeks
> that dm-crypt was also getting multi-key support...maybe in the
> mm-kernel, or for 2.6.13...
Single key is enough for me.

> >I know I don't need a key, but I do want a key (stored in a remobable
> > modia) encripted with a passphrase I will be able to change, or best, my
> > wife can have the key protected with a different passphrase than I do.
> >Beyond that, encripting with a key is much better than doing that with a
> >passphrase because the passphrase can be cracked (dictionary attack) while
> >the key-encripted that can't.
>
> Well, technically, anything can be cracked given enough time and
> computing power.
Yes, ok. I should have added a 'practically' there somewhere.

> For using different passwords, this is possible.  You would need to
> encrypt the same key file with gpg to two different .gpg files....your
> wife can use one, and you can use the other.  If the key files are
> stored on separate pieces of removable media, then you each have your
> own "keys" to the system.
That's the idea, that scheme plus the best superted method out fo the box (or 
the net, hehehe). I believe it is cryptoloop, but I am not sure.

Thanks.
-- 
Pupeno <pupeno@××××××.com> (http://pupeno.com)
Reading ? Science Fiction ? http://sfreaders.com.ar