eessppeelllloo/cryptsetup
1
0
Fork 0
mirror of https://gitlab.com/cryptsetup/cryptsetup.git synced 2025-12-11 19:00:02 +01:00
Code Issues Packages Projects Releases Wiki Activity

Change in iterations counts:

Browse Source 
* Fix key slot iteration count calculation (small -i value was the same as default).
  * The slot and key digest iteration minimun is now 1000.
  * The key digest iteration # is calculated from iteration time (approx 1/8 of that).

If something very strange happens, and the generated key is not completely random
(wrong RNG), attacker can skip the whole kesylot area processing and try to
brute force key according to limited set of keys.

The iteration time (default, inherited from slot iteration time, is cca 120ms)
can make this attack slower, if not impossible.

Note, that this is just theorethic problem, anyway it is better to be prepared
if possible:-)

git-svn-id: https://cryptsetup.googlecode.com/svn/trunk@159 36d66b0a-2a48-0410-832c-cd162a569da5
This commit is contained in:
Milan Broz
2009-12-30 19:02:44 +00:00
parent 163abe3520
commit ad224b479a
5 changed files with 53 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
lib/setup.c
View File

@@ -1101,7 +1101,8 @@ static int _crypt_format_luks1(struct crypt_device *cd,
r = LUKS_generate_phdr(&cd->hdr, cd->volume_key, cipher, cipher_mode,
(params && params->hash) ? params->hash : "sha1",
uuid, LUKS_STRIPES,
params ? params->data_alignment: DEFAULT_ALIGNMENT, cd);
params ? params->data_alignment: DEFAULT_ALIGNMENT,
cd->iteration_time, &cd->PBKDF2_per_sec, cd);
if(r < 0)
return r;