Score:0

May specifying the position of swapfile help defeat LUKS encryption?

ly flag

I need to enable hybernation to the LUKS-encrypted drive. My /boot partition is unencrypted hence it stores all kernel images as well as kernel parameters in unencrypted form. For hybernation to work I should specify where the swap file starts off on my drive where the system can write hybernated data to. For this Linux kernel has "resume_offset" parameter and the same-called /sys variable.

https://www.kernel.org/doc/html/latest/power/swsusp.html

Does specifying resume_offset as a kernel command line parameter upon launching via GRUB aid cryptanalysis against my LUKS partition if my drive gets stolen? The value of resume_offset would be stored unencrypted on /boot/grub/grub.cfg. I suspect an attacker can use information about where the swapfile and the rest of my filesystem are for defeating encryption.

SAI Peregrinus avatar
si flag
Your swap partition needs to also be encrypted if you're enabling suspend-to-disk. https://wiki.archlinux.org/title/Dm-crypt/Swap_encryption#With_suspend-to-disk_support
Score:2
si flag

This will not give an attacker any useful information for cryptanalysis. Knowing where encrypted data is doesn't help an attacker learn anything about how to decrypt the data.

They can get the same information from the partition table to find where your swap partition is anyway.

If you forgot to encrypt your swap partition, that would be catastrophic, since the encryption keys would be written into the swap when you hibernate the system (unencrypted). An attacker could just read the keys from swap and decrypt the disk.

Score:2
vn flag

No, specifying the swap offset does not help an attacker.

Kerckhoffs's principle states that a secure cryptosystem must be designed such that the only material that needs to be secret is the key. Any other information about the system such as its construction or any metadata can be public without harming the security of the system. LUKS follows this principle. Information such as swap offset is not sensitive.

If an attacker knows where the offset of the swap file is, he'll be able to construct some "known plaintext" (such as the swap header). This can be useful in aiding cryptanalysis of weak ciphers. Assuming you are using a strong cipher such as AES (in a secure mode of operation appropriate for disk encryption such as CBC-ESSIV or XTS), you do not need to worry about known plaintext attacks. Even if an attacker knows the entire contents of the swap partition (minus the encryption key, of course) as well as the ciphertext, he will not be able to determine the key.

I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.