New Methods in Hard Disk Encryption Clemens Fruhwirth <[email protected]> Institute for Computer Languages Theory and Logic Group Vienna University of Technology July 18, 2005 Abstract This work investigates the state of the art in hard disk cryptography. As the choice of the cipher mode is essential for the security of hard disk data, we discuss the recent cipher mode developments at two standardisation bodies, NIST and IEEE. It is a necessity to consider new developments, as the most common cipher mode – namely CBC – has many security problems. This work devotes a chapter to the analysis of CBC weaknesses. Next to others, the main contributions of this work are (1) efficient algorithms for series of multiplications in a finite field (Galois Field), (2) analysis of the security of password-based cryptography with respect to low entropy attacks and (3) a design template for secure key management, namely TKS1. For the latter, it is assumed that key management has to be done on regular user hardware in the absence of any special security hardware like key tokens. We solve the problems arising from magnetic storage by introducing a method called anti-forensic information splitter. This work is complemented by the presentation of a system implementing a variant of TKS1. It is called LUKS and it was developed and implemented by the author of this work. Contents Preface v 1 Introduction 1 2 Design ingredients 3 2.1 The many faces of n ........................ 3 2.2 Galois Field arithmetic . 4 2.3 Algorithms for GF(2η)....................... 9 2.4 Sequences of multiplications in GF(2η) . 11 2.5 Gray Code . 21 3 Cipher Modes 25 3.1 Traditional cipher modes and their shortcomings . 26 3.2 Modes for authentication . 30 3.3 Modes accepted for NIST consideration . 33 3.4 NIST: Authenticated Encryption modes . 37 3.5 NIST: Encryption modes . 45 3.6 SISWG . 47 3.7 NIST: Authentication modes . 53 3.8 Evaluating the modes for Hard Disk Encryption . 54 3.9 Summary of Cipher Modes . 56 3.10 Implementation Guide . 58 4 CBC attacks 59 4.1 Initialisation Vector Modes . 59 4.2 Content leak attack . 61 4.3 Watermarking . 65 4.4 Data modification leak . 67 4.5 Malleability . 68 4.6 Movable cipher blocks . 70 4.7 Threat models . 70 5 Password management 73 5.1 Key hierarchies for passwords . 73 5.2 Anti-forensic data storage . 75 5.3 Passwords from entropy weak sources . 79 5.4 TKS1: Template Key Setup 1 . 87 i 6 A tour of LUKS: Linux Unified Key Setup 91 6.1 Disk layout . 92 6.2 Semantics . 94 6.3 LUKS for dm-crypt . 99 A Mathematical supplements 101 Bibliography 107 List of Figures 2.6 Aligned optimise . 15 2.8 Aligned negative logic . 19 2.12 Reflexive Gray code . 22 3.1 CBC Mode . 27 3.2 CFB Mode encryption . 29 3.3 OFB Mode encryption . 30 3.4 CTR Mode encryption . 30 3.5 XCBC-MAC . 32 3.7 2D-Encryption Mode . 46 3.8 LRW-AES Mode . 48 3.10 EME Mode . 50 3.11 ABL4 . 51 4.1 The inflexion point of the collision function . 64 5.1 AFsplitter . 78 5.2 The worlds Top 500 supercomputers’ processing power . 83 5.5 TKS1 scheme . 88 5.6 TKS2 scheme . 89 List of Tables 2.5 The many faces of n . 12 2.7 binary difference table . 16 ii 2.11 Gray Code difference table . 21 5.3 Traversal times for an entire password domain . 86 5.4 Minimum password bits for different security requirements . 87 6.1 PHDR layout . 93 6.2 Key slot layout . 94 Listings 2.1 xtime: multiplication with x and modulo reduction . 9 2.2 base algorithm, xtime-version . 10 2.3 an implementable c’-recursion . 10 2.4 base algorithm, lookup table version . 11 2.5 alignment determination . 14 2.6 Single step via negative logic . 16 2.7 Base algorithm for negative logic . 17 2.9 carry prevention . 18 2.10 Multiplication sequence (hybrid) . 20 3.6 OMAC algorithm . 33 3.9 EME algorithm . 49 3.12 LRW encryption . 58 3.13 optimised EME algorithm, Encryption . 58 6.3 Partition initialisation . 95 6.4 Key setting . 97 6.5 Master key recovery . 98 iii Preface I got involved with hard disk cryptography for the first time in the year 2000. This was much too early, since the regular desktop processors were not able to fulfil my performance expectations. Two years later I repeated my attempt to encrypt my data by default, this time with loop-AES, a high performance encryption package for Linux. But due to its unrefined coding style, next to the author’s dislike for cooperation, the code was never included into any mainstream Linux project. I have always been a fan of integration. For my personal projects, I could say, I wanted my work to be part of something bigger and to be useful to the community. But to be honest, I cooperate with bigger projects like Linux distri- butions or the Linux kernel primarily, because it takes maintenance work away from me. Otherwise, I would have to reintegrate my work with all components when new versions are released. Therefore, I started to put my efforts into another crypto project, which was more likely to be included into mainstream Linux, named “kerneli”. With the advent of Linux 2.6 in 2003 and after having gained experience in how to lobby my code into the Linux kernel, cryptoloop was included into the new release, and the Linux users received a hard disk encryption ready kernel for the first time. cryptoloop was my port based on the loop back device driver from a former kerneli component. But the loop back driver had many unsolved problems attached, and half a year later Christophe Saout presented his superior dm-crypt implementation that was based on a new block device layer called device-mapper. Recognising this, I readjusted my road map and concentrated my efforts on dm-crypt. In the first quarter of 2004, Jari Ruusu, the author of loop-AES, imple- mented the water marking attack against the CBC on-disk format both – cryptoloop and dm-crypt – were using. The attack was not taken seriously, especially not by me, as Jari Ruusu had no good reputation and was known to spread more confusion than facts. After new threat models had shown that this attack can be relevant in some situations, I invented ESSIV to remedy the problem. Unfortunately, most Linux users were not well educated with respect to cryptography and were confused from the mixture of correct and unobjective claims Ruusu was still posting to the Linux mailing list. I started to write a full-disclosure document on all known problems my implementation had. The primary intention was to provide information to the Linux users. But this undertaking lead me much farer. I stumbled consecu- tively into the world of SISWG and their alternative cipher modes. Stunned by the variety of flaws I collected for CBC, I was eager to start using the new SISWG modes. Until now, I have submitted many patches to the Linux v vi PREFACE developers for implementing my favourite of the SISWG modes, LRW-AES. Unfortunately, the Linux kernel virtual memory subsystem is a pure disaster. I refused to create an unaesthetic workaround for its limitations, as my fellow developers requested, and so I stopped my development. Unless this problems are cleared up, there will be no working LRW implementation any time soon for Linux. In fact, there will be no other hard disk solution operating with a SISWG cipher mode any time soon, as my implementation efforts were the only attempt (known to me) to implement them. So, the user has no other option than to use CBC and its probably secure (or not) variants that are included with loop-AES and TrueCrypt. Probably more important than cipher modes is password management. A big step towards tighter security in this field is achieved with my own software I baptised LUKS. This paper presents the theoretic foundations of LUKS in Chapter 5, “Password Management”, and gives a tour of its concrete imple- mentation in Chapter 6. The following work founds on three years of practical experience with usage and programming of encryption systems. I implemented most of the advised solutions on my own, and some of them are already available with default installations. Contributions of this work 1. mathematical primer for Galois Field algorithms, 2. development of specialised algorithms for multiplicative sequences in Ga- lois Fields, 3. analysis of NIST cipher modes with respect to applicability for hard disk encryption, 4. presentation of the Anti-forensic Information Splitter, 5. development and analysis of a technological growth model for quantifying PBKDF2 security, 6. Template Key Setup 1 (TKS1), a guideline for designing secure key man- agement systems, 7. case study of a hard disk encryption system incorporating TKS1, namely Linux Unified Key Setup (LUKS). Acknowledgements I would like to thank Christophe Saout for his rock-stable dm-crypt imple- mentation, Herbert Valerio Riedel for being forthcoming in my early kerneli efforts, Ernst Molitor, Arno Wagner, James Hughes, Pascal Brisset, Grzegorz Kulewski, Ulrich Kuehn, and Adam J. Richter for reviewing the full-disclosure document of CBC, which is predecessor of Chapter 4, the anonymous commen- tator for pointing out an improvement concerning the last block of anti-forensic storage and Laszlo Hars for correcting the false hypothesis of independent prob- abilities in Chapter 4. Thanks to Peter Wilson, who created many useful LATEX vii packages. Without his work, this document would not look as nice.