well, I managed to forget my luks password

Tonglebeak · Guru Joined: 23 Mar 2006 Posts: 362

After using it for 6 months, I guess I forgot it. Everything I entered did not work, and I am unable to find the physical copy of my password anywhere. To make this question simple:

Is there a way to extract the hash from the luks header? I used luksdump but I'm not sure what's what. I know what most of the characters are, and I thought I knew the length...so I can get it close and write up a script on my laptop to try to brute force the hash, that's if it can be recovered.

Thanks.

khayyam · Posted: Sat Jun 23, 2012 8:20 am Post subject:

Tonglebeak ...

The hash can't be extracted, if it could the dmcypt would be open to brute forcing via the hash, dmcypt uses PBKDF2 so the hash is salted. Your only option is to run your crack against the volume, such attacks can't be parallelised, dmcypt makes each attempt consume time.

There is perhaps another reason for your key not working, the luks header is corrupt, of course if you can't be sure of the passphrase then it may be, as your currently thinking, wrong, but header corruption is also a possibility. If you've made a backup of the header then it's possible to replace it from the backup.

HTH & best ...

khay

Tonglebeak · Guru Joined: 23 Mar 2006 Posts: 362

I don't have a backup of the header

luksDump does print out a bunch of info about keyslots and such. Would luksDump print anything out if the header was corrupt?

khayyam · Posted: Sat Jun 23, 2012 2:29 pm Post subject:

Tonglebeak ...

As far as I know, no. I'd imagine having an integrity field, or checksum, would provide a 'crib' which the attacker could use as a starting point.

best ... khay

Hu · Administrator Joined: 06 Mar 2007 Posts: 23082

A checksum for some of the metadata would not reveal anything, since it is very obvious that the volume is a LUKS container. The checksum could safely cover any data that can be obtained by reading the block device. It is only unsafe when the checksum covers data that is protected by the encryption.

khayyam · Posted: Sat Jun 23, 2012 5:37 pm Post subject:

Tonglebeak · Guru Joined: 23 Mar 2006 Posts: 362

Thank. God. I wasn't dumb enough to throw away my password. Did some cleaning and found it.

I can't believe how far off I was. I missed 1 number the entire time, and had another letter out of sequence along with a couple of caps. I can't believe after entering so many times, I just completely botched it. That's what I get for memorizing keystrokes instead of the password itself. One keystroke off and bam it ruined me as I kept trying.

khayyam · Posted: Sun Jun 24, 2012 9:08 am Post subject:

Tonglebeak ...

I also memorise via keystrokes, or keyboard placement, such mnemonic learning is actually easier, but I also use some other mnemonic tricks that allow me to remember how I arrived at the password, and I keep a pass.gpg on a USB stick just incase.

Anyhow, now you know the header isn't corrupt you should make a backup:

Tonglebeak · Guru Joined: 23 Mar 2006 Posts: 362

khayyam · Posted: Mon Jun 25, 2012 9:29 am Post subject:

Goverp · Advocate Joined: 07 Mar 2007 Posts: 2202