Emergency destruction of LUKS partition

[Eric Christensen]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Someone asked me about this recently and I haven't had a chance to fully wrap my head
around the solution but thought it was an interesting scenario.

Background:
Someone knows you have encrypted your computer using LUKS.  They convince you to enter (or
otherwise provide) your passphrase via the large wrench method[0].

Realcrypt method:
There is plausible deniability (if properly implemented) whereas you could provide the
person with the alternate passphrase which would give them access to a portion of the
encrypted partition but not your real working partition.

LUKS:
There is no way to provide plausible deniability.

Proposed solution:
LUKS provides four key slots to use for decrypting a partition.  How about have one key
slot that when used immediately implements a deletion of the encrypted partition (or at
least the key record).

Thoughts?

[0] http://www.xkcd.org/538/

- -- Eric

- --------------------------------------------------
Eric "Sparks" Christensen
Fedora Project

sparks(a)fedoraproject.org - sparks(a)redhat.com
097C 82C3 52DF C64A 50C2  E3A3 8076 ABDE 024B B3D1
- --------------------------------------------------
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.14 (GNU/Linux)
>
> iQGcBAEBCgAGBQJSSaw6AAoJEB/kgVGp2CYvDTAL/jeuWo8r39Apq7QA6hQKmDI9
> Oe+GB5SRk99ecqmBKcapC6nGewfVajoeuNo27AG9CfmQ97ZSk6Oabvt8OibgXXc5
> S64me8zy+Rqx2uu8i271P8DGbf3IFENMMtCdkPCfJWNU5ZAepGwBXCQXRJwC09jn
> MWeQ9kDFmvHZE4a8bO/G6ZPkXI+Vm7BxJYsGq6f5SVcAnqWdKWSUiZPfEcAIGPzx
> AFDmiR8wQpQ2e3PiHEstLYK9DHr6ALIqZxbdwwlLM/vOi7N2Xk3PobIby3KREU4b
> yCh5lkp2oZKkWhGY2AYgFwm1uo7/jWSDFArcJDTtr9amU1mihrpmRPBxAzcplSFK
> oj9LJeYXXnpGFRHNyr68Zp8Dp5ckhDgUVMV1m8MCgVgmyn7cIexIvib4kng/c/aE
> Wo/32VXw8T/++Gszlv4AjLKjMlD4PEVWSO9saJLeQIlwEQFZYulpVkRa/6RKesYZ
> NbuMocam5uk2z0BeXCXjD5A1nvh7YHnhuCjv4HizqQ==
> =Tdc5
> -----END PGP SIGNATURE-----

[Tristan Santore]

On 30/09/13 17:52, Eric H. Christensen wrote:
>  Someone asked me about this recently and I haven't had a chance
> to 
>  fully wrap my head around the solution but thought it was an 
>  interesting scenario.
>  
>  Background: Someone knows you have encrypted your computer using 
>  LUKS.  They convince you to enter (or otherwise provide) your 
>  passphrase via the large wrench method[0].
>  
>  Realcrypt method: There is plausible deniability (if properly 
>  implemented) whereas you could provide the person with the 
>  alternate passphrase which would give them access to a portion of 
>  the encrypted partition but not your real working partition.
>  
>  LUKS: There is no way to provide plausible deniability.
>  
>  Proposed solution: LUKS provides four key slots to use for 
>  decrypting a partition.  How about have one key slot that when
>  used immediately implements a deletion of the encrypted partition
>  (or at least the key record).
>  
>  Thoughts?
>  
>  [0] http://www.xkcd.org/538/
>  
>  -- Eric
>  
>  -------------------------------------------------- Eric "Sparks" 
>  Christensen Fedora Project
>  
>  sparks(a)fedoraproject.org - sparks(a)redhat.com 097C 82C3 52DF C64A 
>  50C2  E3A3 8076 ABDE 024B B3D1 
>  -------------------------------------------------- -- security 
>  mailing list security(a)lists.fedoraproject.org 
>  https://admin.fedoraproject.org/mailman/listinfo/security
>   
There is a DM-Steg module. But somebody would probably have to work a
little more on it and put it into upstream, so it is maintained.

Regards,

Tristan
-- 

Tristan Santore BSc MBCS
TS4523-RIPE
Network and Infrastructure Operations
InterNexusConnect
Mobile [phone]
Tristan.Santore(a)internexusconnect.net

Former Thawte Notary
(Please note: Thawte has closed its WoT programme down,
and I am therefore no longer able to accredit trust)

For Fedora related issues, please email me at:
TSantore(a)fedoraproject.org

[Miloslav Trmač]

On Mon, Sep 30, 2013 at 6:52 PM, Eric H. Christensen
<sparks(a)fedoraproject.org&gt; wrote:
>  Proposed solution:
>  LUKS provides four key slots to use for decrypting a partition.  How about have one key
> slot that when used immediately implements a deletion of the encrypted partition (or at
> least the key record).
>
>  Thoughts? 
If the attacker has the encrypted data, the person knowing the
passphrase, know enough about LUKS to be able to unlock it, and enough
time to extract the passphrase from the victim, they also probably
have enough time to make a full copy of the encrypted partition.
    Mirek

[Kurt Seifried]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 09/30/2013 10:52 AM, Eric H. Christensen wrote:
>  Someone asked me about this recently and I haven't had a chance
> to
>  fully wrap my head around the solution but thought it was an
>  interesting scenario.
>  
>  Background: Someone knows you have encrypted your computer using
>  LUKS.  They convince you to enter (or otherwise provide) your
>  passphrase via the large wrench method[0].
>  
>  Realcrypt method: There is plausible deniability (if properly
>  implemented) whereas you could provide the person with the
>  alternate passphrase which would give them access to a portion of
>  the encrypted partition but not your real working partition.
>  
>  LUKS: There is no way to provide plausible deniability.
>  
>  Proposed solution: LUKS provides four key slots to use for
>  decrypting a partition.  How about have one key slot that when used
>  immediately implements a deletion of the encrypted partition (or at
>  least the key record).
>  
>  Thoughts?
>  
>  [0] http://www.xkcd.org/538/
>  
>  -- Eric 
Because they'll be using a cloned copy most likely. If not you're now
guilt of destruction of evidence. Truecrypt's plausible deniability is
much better, "emergency deletion/crypto shredding is not effective.

There are commercial devices you can plugin that will then let the
attacker clone the system easily while the system is running:

http://www.linux-magazine.com/Issues/2012/140/Security-Lessons-Hacking-Ha...

- -- 
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.14 (GNU/Linux)
>
> iQIcBAEBAgAGBQJSSa56AAoJEBYNRVNeJnmTeeMP/2LM3Q0m7EvK3UaF4GIQyWPU
> mAdgQ4gBiJgRByX2fNT10feGkvi+slTOUSlya4u8R2iya11lvIVKR4aNplC2D9eh
> BzYB5dbDXYpv5CR3AnQivRbe4ZJFRayLzOdgzfMNWHen/QenNupKs0ZfTjVpTqcD
> JVkaCLg5kl5A1iQ2qz0GBdGMC2+7yj+CEOHUrig8NtsySu1O8UWuv3j51JLOGIkW
> /cUBo2AUYqHwDb0a/10oihnF7or/+g5dQOYeKlqHoHUMQHemqz31GalWUjIbP0VS
> kpcJbost4nrWlEXEtWNZPBUI3bOdyQnvJUFqGkwe0fBsMVs0S+04VunO0gSF8Ly7
> pgriFkxEbVnLOSLHpVfs0EvBIsvxYU/ffCBGempDZHaQij8cMZat9NtF3TH6bnOi
> yj7aqL/Y5jMzAf/j3NUEVrkfrURUCWrw7umdB+1Zz6j7qIG6U496UtWqpAIywCWe
> zAuao3UgaKoKUb2uqIbFez/xZCSi/CVSik/RsTd/g5QxW+EpcJBKcZgb044s9l1a
> ZiWykwl8MLR7ZNa80P8amPRT2678fICUNc42acDq4RNLXme/befBywythtMkl0Gp
> AZ5zM4BYDfNFa1LskMwxEW7MZpeJVUxumwB6DMkgglK5GjTJW0h7/vPQkGXxBAsD
> NCPNu+GzLNrrQw9hVKrB
> =0k9E
> -----END PGP SIGNATURE-----

[Joe Wulf]

If the implementation of this is in fact a deep dark secret that only the implementers on
'that' system know, as well as the users... then this might be a possibility to
protect the data at the expense of the person or persons lives on the wrong end of the
large wrench.

The kind of implementation you are talking about, more than likely, would already be known
to wrench-wielding miscreants.  Therefore, they'd be on the look-out for attempts at
giving the wrong key phrase.




> ________________________________
>  From: Eric H. Christensen <sparks(a)fedoraproject.org&gt;
> To: security(a)lists.fedoraproject.org 
> Sent: Monday, September 30, 2013 12:52 PM
> Subject: Emergency destruction of LUKS partition
>  
>
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA512
>
> Someone asked me about this recently and I haven't had a chance to fully wrap my head
> around the solution but thought it was an interesting scenario.
>
> Background:
> Someone knows you have encrypted your computer using LUKS.  They convince you to enter (or
> otherwise provide) your passphrase via the large wrench method[0].
>
> Realcrypt method:
> There is plausible deniability (if properly implemented) whereas you could provide the
> person with the alternate passphrase which would give them access to a portion of the
> encrypted partition but not your real working partition.
>
> LUKS:
> There is no way to provide plausible deniability.
>
> Proposed solution:
> LUKS provides four key slots to use for decrypting a partition.  How about have one key
> slot that when used immediately implements a deletion of the encrypted partition (or at
> least the key record).
>
> Thoughts?
>
> [0] http://www.xkcd.org/538/
>
> - -- Eric
>
> - --------------------------------------------------
> Eric "Sparks" Christensen
> Fedora Project
>
> sparks(a)fedoraproject.org - sparks(a)redhat.com
> 097C 82C3 52DF C64A 50C2  E3A3 8076 ABDE 024B B3D1
> - --------------------------------------------------
> > -----BEGIN PGP SIGNATURE-----
> > Version: GnuPG v1.4.14 (GNU/Linux)
> >
> > iQGcBAEBCgAGBQJSSaw6AAoJEB/kgVGp2CYvDTAL/jeuWo8r39Apq7QA6hQKmDI9
> > Oe+GB5SRk99ecqmBKcapC6nGewfVajoeuNo27AG9CfmQ97ZSk6Oabvt8OibgXXc5
> > S64me8zy+Rqx2uu8i271P8DGbf3IFENMMtCdkPCfJWNU5ZAepGwBXCQXRJwC09jn
> > MWeQ9kDFmvHZE4a8bO/G6ZPkXI+Vm7BxJYsGq6f5SVcAnqWdKWSUiZPfEcAIGPzx
> > AFDmiR8wQpQ2e3PiHEstLYK9DHr6ALIqZxbdwwlLM/vOi7N2Xk3PobIby3KREU4b
> > yCh5lkp2oZKkWhGY2AYgFwm1uo7/jWSDFArcJDTtr9amU1mihrpmRPBxAzcplSFK
> > oj9LJeYXXnpGFRHNyr68Zp8Dp5ckhDgUVMV1m8MCgVgmyn7cIexIvib4kng/c/aE
> > Wo/32VXw8T/++Gszlv4AjLKjMlD4PEVWSO9saJLeQIlwEQFZYulpVkRa/6RKesYZ
> > NbuMocam5uk2z0BeXCXjD5A1nvh7YHnhuCjv4HizqQ==
> > =Tdc5
> > -----END PGP SIGNATURE----- 
> --
> security mailing list
> security(a)lists.fedoraproject.org
> https://admin.fedoraproject.org/mailman/listinfo/security
>
>

[Tristan Santore]

On 30/09/13 18:16, Joe Wulf wrote:
>  If the implementation of this is in fact a deep dark secret that
> only
>  the implementers on 'that' system know, as well as the users... then
>  this might be a possibility to protect the data at the expense of the
>  person or persons lives on the wrong end of the large wrench.
>  
>  The kind of implementation you are talking about, more than likely,
>  would already be known to wrench-wielding miscreants.  Therefore, they'd
>  be on the look-out for attempts at giving the wrong key phrase.
>   
That is why you use steganography to hide the data. So to the person
inspecting, it looks just like garbled rubbish on disc.
However, if you apply that to your main system, that is kind of stupid,
as everyone will know you have a system there.

For those interested though, here the link to the dm-steg stuff.
Including a git repo.

Looks kind of unmaintained. Would require some crypt-analysis people
and coders to look at the code. To make sure it is sound.

Peer review and all that jazz.

http://dmsteg.sourceforge.net/

Regards,

Tristan
-- 

Tristan Santore BSc MBCS
TS4523-RIPE
Network and Infrastructure Operations
InterNexusConnect
Mobile [phone]
Tristan.Santore(a)internexusconnect.net

Former Thawte Notary
(Please note: Thawte has closed its WoT programme down,
and I am therefore no longer able to accredit trust)

For Fedora related issues, please email me at:
TSantore(a)fedoraproject.org

[Luke Macken]

On Mon, Sep 30, 2013 at 12:52:13PM -0400, Eric H. Christensen wrote:
>  Realcrypt method:
>  There is plausible deniability (if properly implemented) whereas you
>  could provide the person with the alternate passphrase which would
>  give them access to a portion of the encrypted partition but not your
>  real working partition. 
Unlike True/RealCrypt, we do ship tcplay, which is a free TrueCrypt implementation based
on dm-crypt. I've never played with it, but it apparently supports
hidden volumes.

http://www.truecrypt.org/docs/hidden-volume
https://apps.fedoraproject.org/packages/tcplay

luke

[Bruno Wolff III]

On Mon, Sep 30, 2013 at 12:52:13 -0400,
   "Eric H. Christensen" <sparks(a)fedoraproject.org&gt; wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA512
>
> Someone asked me about this recently and I haven't had a chance to fully wrap my head
> around the solution but thought it was an interesting scenario.
>
> Background:
> Someone knows you have encrypted your computer using LUKS.  They convince you to enter (or
> otherwise provide) your passphrase via the large wrench method[0].
>
> Realcrypt method:
> There is plausible deniability (if properly implemented) whereas you could provide the
> person with the alternate passphrase which would give them access to a portion of the
> encrypted partition but not your real working partition.
>
> LUKS:
> There is no way to provide plausible deniability.
>
> Proposed solution:
> LUKS provides four key slots to use for decrypting a partition.  How about have one key
> slot that when used immediately implements a deletion of the encrypted partition (or at
> least the key record).
>
> Thoughts? 
They'll just keep using the wrench until you tell them all of the passwords.

Even plausible deniability might not work so well, if someone who knows 
what their doing looks at you disk.

[Richard Guy Briggs]

On Mon, Sep 30, 2013 at 01:40:37PM -0500, Bruno Wolff III wrote:
>  On Mon, Sep 30, 2013 at 12:52:13 -0400,
>    "Eric H. Christensen" <sparks(a)fedoraproject.org&gt; wrote:
>  >-----BEGIN PGP SIGNED MESSAGE-----
>  >Hash: SHA512
>  >
>  >Someone asked me about this recently and I haven't had a chance to fully wrap my
> head around the solution but thought it was an interesting scenario.
>  >
>  >Background:
>  >Someone knows you have encrypted your computer using LUKS.  They convince you to
> enter (or otherwise provide) your passphrase via the large wrench method[0].
>  >
>  >Realcrypt method:
>  >There is plausible deniability (if properly implemented) whereas you could provide
> the person with the alternate passphrase which would give them access to a portion of the
> encrypted partition but not your real working partition.
>  >
>  >LUKS:
>  >There is no way to provide plausible deniability.
>  >
>  >Proposed solution:
>  >LUKS provides four key slots to use for decrypting a partition.  How about have one
> key slot that when used immediately implements a deletion of the encrypted partition (or
> at least the key record).
>  >
>  >Thoughts?
>  
>  They'll just keep using the wrench until you tell them all of the passwords. 
This isn't theoretical.  That's pretty much exactly what happenned to my
grandfather:
	http://en.wikipedia.org/wiki/Gustave_Bieler

>  Even plausible deniability might not work so well, if someone who
>  knows what their doing looks at you disk.
>  --
>  security mailing list
>  security(a)lists.fedoraproject.org
>  https://admin.fedoraproject.org/mailman/listinfo/security 
- RGB

--
Richard Guy Briggs <rbriggs(a)redhat.com&gt;
Senior Software Engineer
Kernel Security
AMER ENG Base Operating Systems
Remote, Ottawa, Canada
Voice: +1.647.777.2635
Internal: (81) 32635
Alt: +1.613.693.0684x3545

[Will Yonker]

>  On Mon, Sep 30, 2013 at 12:52:13 -0400,
>  "Eric H. 
Christensen" <sparks(a)fedoraproject.org&gt; wrote:
>  
>  They'll just keep using the wrench until you tell them all of 
the
>  passwords.
>  
>  Even plausible deniability 
might not work so well, if someone who knows
>  what their doing 
looks at you disk.

If your data is valuable enough (or you are
paranoid enough) you could try something like this:

There are
services that provide disappearing web sites.  You could have your
encryption program make part of your key from such a web site.  Every
time you decrypt your volume for use, it removes the old site/key and
creates a new site/key (which you would have to memorize).  The site
would disappear after 24 hours automatically or 2 failed login
attempts.  So, if you wait long enough or give them a bad password,
your data is gone because you no longer actually have the key.  Well,
there isn't a key anymore so...

---
Will Y.

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

[Will Yonker]

>  There are
>  services that provide disappearing web 
sites.  You could have your
>  encryption program make 
part of your key from such a web
site.  Every
>  time 
you decrypt your volume for use, it removes the old
site/key and
>  
creates a new site/key (which you would have to memorize). 
The site
>  would disappear after 24 hours automatically or 2 
failed login
>  attempts.  So, if you wait long enough 
or give them a bad
password,
>  your data is gone because you no 
longer actually have the
key.  Well,
>  there isn't a 
key anymore so...

I said that wrong.  You never know what
the key phrase is on the web site.  It is auto-generated.  The
program picks up that part automatically and generates a new key each time
you decrypt.  

---
Will Y.

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

[Lyos Gemini Norezel]

Personally... I just use the thermite/C4 method.

Ie., someone removes the hard drive == auto hd destruction via hidden 
thermite or c4 ignition.

I also set it to trigger via too many incorrect password attempts.

That's only for my really important data though... the rest I don't care 
enough about to be that paranoid.

Given that I also have roughly 50 hard drives (200GB and up)... there's 
a level of security by obscurity as well... in that they'd have to find 
the correct one first.


If your data is that important... relying on software shredding is 
idiotic, at best.

--Lyos Gemini Norezel

On 09/30/2013 04:27 PM, aragonx(a)dcsnow.com wrote:
>  > On Mon, Sep 30, 2013 at 12:52:13 -0400,
>  > "Eric H. Christensen" <sparks(a)fedoraproject.org&gt; wrote:
>  >
>  > They'll just keep using the wrench until you tell them all of the
>  > passwords.
>  >
>  > Even plausible deniability might not work so well, if someone who knows
>  > what their doing looks at you disk.
>
>  If your data is valuable enough (or you are paranoid enough) you could 
>  try something like this:
>
>  There are services that provide disappearing web sites.  You could 
>  have your encryption program make part of your key from such a web 
>  site. Every time you decrypt your volume for use, it removes the old 
>  site/key and creates a new site/key (which you would have to 
>  memorize).  The site would disappear after 24 hours automatically or 2 
>  failed login attempts.  So, if you wait long enough or give them a bad 
>  password, your data is gone because you no longer actually have the 
>  key. Well, there isn't a key anymore so...
>
>  ---
>  Will Y.
>  -- 
>  This message has been scanned for viruses and
>  dangerous content by *MailScanner* <http://www.mailscanner.info/>;, and is
>  believed to be clean.
>
>
>  --
>  security mailing list
>  security(a)lists.fedoraproject.org
>  https://admin.fedoraproject.org/mailman/listinfo/security