From 60d60d971a64d3cb7bdbbe5abb9e1bc3ee28c5ae Mon Sep 17 00:00:00 2001 From: Debian User Date: Thu, 23 Feb 2012 01:38:40 +0100 Subject: [PATCH] synced with wiki --- FAQ | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/FAQ b/FAQ index 85f18e45..b41d233a 100644 --- a/FAQ +++ b/FAQ @@ -46,7 +46,8 @@ A. Contributors That means that if you distribute an image to several machines, the same master key will be used on all of them, regardless of whether you change the passphrases. Do NOT do this! If you do, a root-user - on any of the machines can decrypt all other copies, breaking + on any of the machines with a mapped (decrypted) container or a + passphrase on that machine can decrypt all other copies, breaking security. See also Item 6.15. DISTRIBUTION INSTALLERS: Some distribution installers offer to @@ -1347,6 +1348,11 @@ http://code.google.com/p/cryptsetup/source/browse/trunk/misc/luks-header-from-ac RAID-components and the like. These are just the normal problems binary cloning causes. + Note that if you need to ship (e.g.) cloned LUKS containers with a + default passphrase, that is fine as long as each container was + individually created (and hence has its own master key). In this + case, changing the default passphrase will make it secure again. + 7. Interoperability with other Disk Encryption Tools