why is it a risk to clone a LUKS container?

Posted by laramichaels on Ask Ubuntu See other posts from Ask Ubuntu or by laramichaels
Published on 2012-06-08T22:33:05Z Indexed on 2012/06/08 22:47 UTC
Read the original article Hit count: 243

Filed under:

encryption

|

luks

I recently installed Ubuntu onto an encrypted partition using the LUKS+LVM combination that the 'alternate' installer offers. Now I want to create backups of my HD.

From the LUKS FAQ:

6.15 Can I clone a LUKS container?

You can, but it breaks security, because the cloned container has the same header and hence the same master key. You cannot change the master key on a LUKS container, even if you change the passphrase(s), the master key stays the same. That means whoever has access to one of the clones can decrypt them all, completely bypassing the passphrases.

How can the existence of a perfect clone of my encrypted HD break security if it contains the exact same information as my live encrypted HD?

In which sense does keeping updated clones of my LUKS-encrypted HD around "break security"?

© Ask Ubuntu or respective owner

Related posts about encryption

SQL SERVER – History of SQL Server Database Encryption

as seen on SQL Authority - Search for 'SQL Authority'
I recently met Michael Coles and Rodeney Landrum the author of one of the kind book Expert SQL Server 2008 Encryption at SQLPASS in Seattle. During the conversation we ended up how Microsoft is evolving encryption technology. The same discussion lead to talking about history of encryption tools in… >>> More
Encryption is hard: AES encryption to Hex

as seen on Stack Overflow - Search for 'Stack Overflow'
So, I've got an app at work that encrypts a string using ColdFusion. ColdFusion's bulit-in encryption helpers make it pretty simple: encrypt('string_to_encrypt','key','AES','HEX') What I'm trying to do is use Ruby to create the same encrypted string as this ColdFusion script is creating. Unfortunately… >>> More
Encryption Product Keys : Public and Private key encryption

as seen on Stack Overflow - Search for 'Stack Overflow'
I need to generate and validate product keys and have been thinking about using a public/private key system. I generate our product keys based on a client name (which could be a variable length string) a 6 digit serial number. It would be good if the product key would be of a manageable length… >>> More
Confused about encryption with public and private keys (which to use for encryption)

as seen on Stack Overflow - Search for 'Stack Overflow'
I am making a licensing system when clients ask my server for a license and I send them a license if they are permitted to have one. On my current system I encrypt the license using a single private key and have the public key embedded into the client application that they use to decrypt the license… >>> More
Software tools to automatically decrypt a file, whose encryption algorithm (and/or encryption keys)

as seen on Stack Overflow - Search for 'Stack Overflow'
I have an idea for encryption that I could program fairly easily to encrypt some local text file. Given that my approach is novel, and does not use any of the industry standard encryption techniques, would I be able to test the strength of my encryption using 'cracker' apps or suchlike? Or do all… >>> More

Related posts about luks

Encrypting a non-linux partition with LUKS.

as seen on Ask Ubuntu - Search for 'Ask Ubuntu'
I have a non-Linux partition I want to encrypt with LUKS. The goal is to be able to store it by itself on a device without Linux and access it from the device when needed with an Ubuntu Live CD. I know LUKS can't encrypt partitions in place, so I created another, unformatted partition of the EXACT… >>> More
LUKS no longer accepts my my passphrase

as seen on Ask Ubuntu - Search for 'Ask Ubuntu'
I created a 4 drive RAID5 setup using mdadm and upgrading from 2TB drives to the new Hitachi 7200RPM 4TB drives. I can initially open my luks partition, but later can no longer access it. I can no longer access my LUKS partition even tho I have the right passphrases. It was working and then at an… >>> More
Kubuntu 9.10: LUKS-encrypt entire partition

as seen on Super User - Search for 'Super User'
Hi, In older versions of Ubuntu, mainly 8.04, I could encrypt en entire partition using LUKS, and mount it as /. the /boot directory was mounted on another partition. At boot time, I had to enter my password to enable any access to anything other than /boot. In Kubuntu 9.10, I only have the option… >>> More
Does LUKS encryption affect TRIM? (SSD and linux)

as seen on Super User - Search for 'Super User'
I'm moving over to Linux when the new SSD arrives. SSD gives increased performance, so I thought that I could encrypt everything. But then I came to think about TRIM, and garbage collection on the drive. Will a LUKS encrypted drive affect the garbage collection system? (TRIM). >>> More
Does luks ecryption effect TRIM? (SSD and linux)

as seen on Super User - Search for 'Super User'
I'm moving over to linux when the new SSD arrives. SSD gives increased performance, so I thought that I could encrypt everything. But then I came to think about TRIM, and garbage collection on the drive. Will luks encrypted drive effect the garbage collection system? (trim). >>> More