LinuxQuestions.org
Help answer threads with 0 replies.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 08-09-2011, 09:22 PM   #1
lucmove
Senior Member
 
Registered: Aug 2005
Location: Brazil
Distribution: Debian
Posts: 1,432

Rep: Reputation: 110Reputation: 110
LUKS partitions: all or nothing?


Does LUKS encryption store data in such a way that any accidents involving loss of data in an unmounted partition would render the entire partition unusable, or is it possible to destroy just a few files atomically so it would still be possible to mount that partition and retrieve other files?

Backstory:

I was installing OpenBSD on a hard disk with about a dozen partitions: NTFS, FAT, EXT3, EXT4 and 3 partitions encrypted with LUKS. I made a mistake and told OpenBSD to use the whole disk instead of one partition. I realized my mistake some 4 or 5 seconds later, then I pressed Ctrl+c and killed the process. I suddenly had a blank HDD with a very large partition, a very small partition and no more Grub.

I had backups, but they were a few days old so I attempted recovery with a program called Testdisk. It worked. I recovered everything. I can even decrypt/open/mount my LUKS partitions.

Except that one of them took longer to comply. It refused to decrypt in the first couple of attempts. It finally gave in. Maybe I was mistyping the password. I don't know.

Anyway, I opened these partitions and tested many files. Everything seemed OK. After a couple of hours, I was editing text files in a particular directory with many text files and ran into one that is completely mangled, garbled, corrupt. Beyond any chance of recovery.

I have another copy of that file, but now I am apprehensive. Could any other file in those encrypted partitions have been corrupted by that accident? Or is that completely unrelated? I am wondering, does LUKS work in such a way that any corruption would destroy the entire partition, or is it possible to destroy just a few files atomically?

Last edited by lucmove; 08-10-2011 at 01:12 AM.
 
Old 08-10-2011, 11:55 AM   #2
BlackRider
Member
 
Registered: Aug 2011
Posts: 295

Rep: Reputation: 101Reputation: 101
The way LUKS corruption works:

If a stream of random bites hits the filesystem when it is opened, the resulting corruption would be the same that you could expect from an usual filesystem.

If a stream of random bites hits the partition where the LUKS volume is placed, there can happen many things:

-- The LUKS header is affected. Unless you have a backup of the header, you have lost your data forever.

-- One or more blocks of encrypted data are affected. The result of this depends on the algorithm, initialization vector you use, etc. A 512 bytes block (for example) that has its twentieth byte corrupted is only readable up to byte 19, and the rest of it is lost. I think that, with most encryption configurations out there, the corruption would not spread to other blocks (Can someone confirm this?).

So, if corruption hit some data blocks, you could loose a few files, but hardly the whole filesystem.

Last edited by BlackRider; 08-10-2011 at 12:01 PM.
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Encrypted partitions (LUKS) or loopback files (cryptmount)? lucmove Linux - Software 0 04-11-2011 04:34 AM
LUKS on RAID or RAID on LUKS? retch Linux - Server 3 05-05-2010 01:57 PM
LUKS fakie_flip Linux - Software 1 12-24-2009 12:06 PM
Mount hangs while trying to mount luks partitions after upgrade to 12.2 MeatPuppet Slackware 5 03-08-2009 07:57 AM
Luks Lockywolf Slackware 2 06-17-2008 03:52 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 05:38 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration