0

I've gathered that persistent storage in Tails uses LUKS, but I can't find the specifics of the encryption, e.g. the algorithm.

Most of the Tails website and other various places is scant with details. The most in-depth page on Tails' website that I've found is this one, and it just says that it uses LUKS.

Running tails-persistence-setup --verbose didn't mention LUKS or any specifics at all really.

I've tried peeking at the source code, but it's written in Perl (which I'm not familiar with). The furthest I got in following the logic of the source code is to this here line which I think is just before the encrypted filesystem is created in udisks_service or Format or something (I don't know Perl).

I searched for instances of "aes", "twofish", "serpent", "128", "256", "512", "xts", "cbc", and "luks" in the files in this source directory and its sub-directories (/usr/share/perl5/Tails/Persistence on the Tails filesystem), but nothing fruitful came of it. I can't find the details of persistence encryption anywhere in the Tails source code or on Tails while it's running.

If you know the answer pls spill the beans

Edit: After more digging, I found this sentence in the UDisks reference manual:

If the option encrypt.passphrase is given then a LUKS device is created with the given passphrase and the file system is created on the unlocked device. The unlocked device will be left open. This parameter can be used to supply the binary contents of an arbitrary keyfile by passing a value of type “ay”. Option encrypt.type can be used to specify encryption "technology" that will be used. Currently only “luks1” and “luks2” are supported.

The option encrypt.passphrase is given in Setup.pm, so encrypt.type is either "luks1" or "luks2".

In the udisks source, this is where the encryption happens. But right now I still don't know what "luks1" and "luks2" mean for encryption specs.

Edit 2: Running this command gave some information about a persistent storage created on Tails 4.4: sudo cryptsetup status luks*

  type:    LUKS1
  cipher:  aes-xts-plain64
  keysize: 512 bits
  key location: dm-crypt
  sector size:  512
  offset:  4096 sectors
Improve this question
1

1 Answer 1

Reset to default
0

Here's the information that Tails produces on encryption. You have the choice between LUKS and VeraCrypt. Both links contain a table on the Pros and Cons of each.

According to Wikipedia, "LUKS is designed to conform to the TKS1 secure key setup scheme."

Also According to Wikipedia:

"Algorithms Individual ciphers supported by VeraCrypt are AES, Serpent, Twofish, Camellia, and Kuznyechik. The Magma cipher was removed in version 1.19 in response to a security audit.[11] Additionally, ten different combinations of cascaded algorithms are available: AES–Twofish, AES–Twofish–Serpent, Camellia–Kuznyechik, Camellia–Serpent, Kuznyechik–AES, Kuznyechik–Serpent–Camellia, Kuznyechik–Twofish, Serpent–AES, Serpent–Twofish–AES, and Twofish–Serpent.[12] The cryptographic hash functions available for use in VeraCrypt are RIPEMD-160, SHA-256, SHA-512, Streebog and Whirlpool/"

Improve this answer
4
  • Tails doesn't support the creation of Veracrypt volumes. It only ever uses LUKS for persistent storage (on the boot USB) and for encrypting other volumes. The TKS1 secure key setup scheme only deals with key derivation, not specifically the actual encryption itself.
    – Catherine Martin
    Commented Mar 20, 2020 at 23:02
  • The scheme is described on page 6 of this paper, and it only ever refers to a generic "cipher".
    – Catherine Martin
    Commented Mar 20, 2020 at 23:16
  • I provided the best information that I could. If you need further help, it is best to go to the source and ask people working on the project(s) directly. tails.boum.org/support/index.en.html
    – elmerjfudd
    Commented Mar 21, 2020 at 8:46
  • 1
    Good idea. Btw I meant no offence in my replies :}
    – Catherine Martin
    Commented Mar 21, 2020 at 15:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .