Upgrading LUKS Key Derivation Function
While everything in a Tails OS session is wiped from system memory after the laptop is switched off, the option to store data persistently in an encrypted partition (the Persistent Storage) is a critical feature for users, such as journalists, who, for example, need to create notes, save material and draft reports during a session.
The encryption used for this - LUKS - is the standard for disk and volume encryption in Linux. If the password is relatively strong, it should be virtually impossible for an adversary to decrypt the data. Is it, though?
Over the years, I’ve heard people, who are supposed to be security experts, state it would take millions, or billions of years to decrypt, through a bruteforce attack, something encrypted with some cipher or other. Well, perhaps that’s true for the cipher, cryptographic key and encrypted data in isolation, but in the real world, encryption keys are derived from passwords. Passwords are weaker than encryption keys, and encryption keys must be stored somewhere, however temporarily.
I came across the security advisory published by SecureDrop earlier this week, which points to a weakness in how encryption keys are generated in the older version of LUKS, or at least it states there’s a safer key derivation algorithm we could be using.
The Tails OS advisory states:
‘The cryptographic parameters of LUKS from Tails 5.12 or earlier are weak against a state-sponsored attacker with physical access to your device.’
Basically if one is involved in something serious enough to warrant an intelligence organisation expending a vast amount of resources over the course of weeks and months to decrypt the material, there might be cause for concern.
Matthew Garrett speculated that law enforcement managed to access the data of a French anarchist, who used LUKS with a considerably strong password to encrypt data on his laptop:
‘My personal computer, which runs with Ubuntu 18, is encrypted with Luks (the password is more than twenty characters: letters, numbers, punctuation marks…). I couldn’t find in the file any indication of the means they used to decrypt it, […] There are even files that had been deleted and emails that had been downloaded with Thunderbird (and then deleted). […] I think the very fact that they were able to gain access to hard drives encrypted with software that was supposed to be tamper-proof needs to be known as widely as possible.’
It’s hard to know what to make of this, without further information. Assuming the report is gen, there are a number of explanations that are far more plausible than the authorities having successfully decrypted the data through bruteforce: The email service provider(s) co-operated with the authorities. The password was written or stored in a way that made it recoverable. There was a defect in how the encryption was implemented or configured. The laptop was running when he was arrested… There are many possible failures in how encryption is used.
Key Derivation
The older version of LUKS use PBKDF2 for generating the encryption key from a password. PBKDF2 includes a feature that forces the operation to be performed x number of times (i.e. 500,000 times) to generate the encryption key, from each input, thereby making a large number of attempts more time and resource consuming. This is less of a problem for attackers now, with GPUs making parallel computing more accessible and scalable.
Another key derivation algorithm, Argon2id, introduces a memory cost as well as a processing cost, which severely limits the number of bruteforcing operations that could be performed at a given moment by consuming more memory with each additional processor.
Upgrading Tails OS and Persistent Storage Encryption
Thankfully the process of upgrading the Persistent Storage encryption to LUKS2 is straightforward in Tails OS. If there are concerns about data loss, it’s possible to load a VeraCrypt container and copy the Persistent Storage contents to that.
I started up Tails, setting the administrator password, unlocking the Persistent Storage and connecting to Tor. After a few minutes, Tails prompted me to upgrade, and I clicked the ‘Okay’ button.
After applying the upgrade and restarting Tails, it will take a while to unlock the Persistent Storage again, as it re-encrypts the partition.
To verify the encryption scheme was upgraded, I run the following in the terminal:
#cryptsetup status TailsData_unlocked
This will give us the cipher, cipher mode and byte encoding. Here it is AES in XTS mode. As I understand it, in this case, we have AES256 encryption, with the 512-bit key being split into two 256-bit keys.
The output, after the upgrade, will be something like:
type: LUKS2
cipher: aes-xts-plain64
keysize: 512 bits
key location: keyring