Posted Apr 18, 2023 15:35 UTC (Tue) by gray_-_wolf (subscriber, #131074) [Link]

Garrett: PSA: upgrade your LUKS key derivation function

The default is to use enough iterations so unlocking takes 2 seconds worth of time on the host CPU. On my 2019 mid-range CPU that's 3,591,012 iterations. Even with a netbook CPU you should be pushing 1 million.

For comparison, LastPass got in hot water for still having users' passwords with various old defaults: 1 iteration or 500 or 5000 or 100,100. They now recommend 600,000 iterations.
Django web framework also defaults to 600,000 (to be fair, this is a DoS vector, so webapps probably don't want to go unnecessarily high).

Posted Apr 18, 2023 16:48 UTC (Tue) by rgmoore (✭ supporter ✭, #75) [Link]

My personal philosophy is: Why not?

Because most people are terrible at memorizing that kind of thing. If you can, more power to you, but most people can't. If they try, they'll be at constant risk of forgetting their password, which is a serious security failure in itself. This is a critical point: for most users, KDF-based attacks on their LUKS password are largely theoretical. They only matter if someone steals their device and is willing to put a lot of effort into cracking it. In contrast, forgetting one's password and being locked out of a critical device is a constant, real problem. Practical security should focus more on common, boring problems than rare, dramatic ones.

That's not to say nobody should bother upgrading their KDF. Swapping out a weaker function for a stronger one is exactly the kind of behind-the-scenes change system designers should be doing. It will improve security with no substantial user-visible change. As long as users are careful about it so they don't lock themselves out, switching in place seems like a good plan, too.

Posted Apr 18, 2023 20:53 UTC (Tue) by berto (subscriber, #58604) [Link]

Posted Apr 18, 2023 21:02 UTC (Tue) by lunaryorn (subscriber, #111088) [Link]

The KDF doesn't really matter if the input is already a strong key, such as a truly random recovery key or anything that comes out of FIDO, TPM, etc. You could use these directly as keys, if only cryptsetup let you (t doesn't, LUKS2 always wants a KDF).

If you enroll a passphrase systemd-cryptenroll will pick argon2id, at least in recent versions.

Don't be an anarchist (or be influenced by whatever other utopian philosophy is in vogue). And if you still choose to follow such a philosophy: make sure your memory is near perfect; never write anything down; reveal as little as possible about yourself (which should be next to nothing); and know as little of your fellow lunatics as is feasible (again, that is next to nothing). Yes, that's pretty hard.

Otherwise you will probably screw up your security. If not, you will run into laws that allow to imprison you for, say, not revealing the password of your encrypted device (that is the best outcome) or into https://xkcd.com/538/ (a not so nice outcome).