The cryptographic safety of encrypted partitions

[halfgaar]

I've got a question about cryptographic security, specificly when dealing with partitions. Let's consider a newly created LUKS partition. After the creation, should you format it with a tool which completely zeroes out the entire partition (like Windows' full format does), you will have large repetative sequences on your disk. If you analyse the encrypted data, and find a certain pattern very often, like 0x4a, then you know it's very likely that 0x00 encrypts to 0x4a. You then can far more easily determine the key used, right?

The example with a format tools which writes nothing but zeroes is extreme (mke2fs and reiser don't do it, for instance), but the example still stands. It's very likely partitions eventually have very repetative data written to them, like bittorrent client which allocate the data first (and doesn't use sparse files). As with the format, this will create a lot of sequencial zeroes. You then have a good base for crypto analysis.

Another example would be the partition header and/or first few kilobytes. There are only so many filesystems, so you know what to look for. The filesystems' magic number (if it has one) makes it even more easy.

Are the algorithms designed to prevent detection of expected data? Or, is determining the key for known patterns (like the 0x00->0x4a example above) more difficult than I think?

Any thoughts would be welcome.

[visi]

That depends on how paranoid you are. If your paranoia level==extreme then I suggest having an external usb drive and an incinerator handy. I read these the other day and while not exactly on topic, quite useful for setting a paranoia level.

Secure Deletion of Data from Magnetic and Solid-State Memory
http://www.cs.auckland.ac.nz/~pgut001/pubs/secure_del.html

Data Remanence in Semiconductor Devices
http://www.cypherpunks.to/~peter/usenix01.pdf

Also this seems a little outdated but still quite useful
http://www.sdc.org/~leila/usb-dongle/readme.html

[halfgaar]

Forgive me for not reading the entire articles, but I think I know what they're about. I know about magnetic retention and stuff, and that when you know what pattern was used to erase a disk (like zeroes), you can then filter out this pattern and have the original data. I always use Darik's Boot and Nuke (on the ultimate boot CD) to erase disks before I dump them. The funny thing is, that erasing like that is better than throwing it in the river or blowing up the building they were in.

However, I've also heard claims that on modern drives, the data density is too high for such advanced recovery methods (recovering a with zeroes erased disk), and that such techniques only work with those x-hunderd MB disks. But, better safe then sorry...

I never investigated this issue for solid state memory, BTW. Also interesting.

But, are there any people here who know exactly how symmetrical encryption, like AES, works? Is it really easy to determine the key if you know 0x00 encrypts to 0x4a, for example?

[Sachankara]

Both cryptsetup-luks and encfs encodes each block (and file for encfs) with a different key, thus making it extremely hard to see any patterns. The encryption methods should be very safe.
_________________
Gentoo Hardened Linux 2.6.21 + svorak (Swedish dvorak)

[daemonflower]

If you are extremely paranoid (which you seem to be), you can do, after the cryptsetup command, a

[halfgaar]

I am paranoid, true , but I don't think that is really necessary... Filling a disc which was previously unecrypted with random data is vital of course, otherwise your original data may still exist on parts of the disc that are not used again after encryption.

[think4urs11]

[sundialsvc4]

What you are describing is a so-called "known plaintext attack," where excerpts of known or predicted plaintext, and/or the statistical characteristics thereof, are used in an effort to either determine the key or to significantly reduce the size of the keyspace that would have to be exhaustively searched for it.

All of the cryptographic algorithms used in encrypted filesystems have been extensively cryptanalyzed for their possible vulnerability to known-plaintext attacks. While it is certainly possible that large blocks of known zeroes might present a theoretical problem, filesystems (and other crypto applications) typically compress the data before encrypting it, and they "salt" the encryption-key with a cryptographically-strong random element.

The weakness of an encrypted filesystem will not be the encryption algorithm nor its application; the weakness will be the key and the handling of that key. Virtually every cryptosystem that is successfully attacked is broken through some aspect of the key-management.

[halfgaar]