Re: [Tails-dev] thoughts about the persistence encryption

Hi,

Daniel Kahn Gillmor wrote (18 Feb 2015 23:50:20 GMT) :
> On Wed 2015-02-18 16:24:51 -0500, goupille wrote:
>> iteration time: it is low for slow systems, and Tails is aimed to work
>> on relatively slow systems it should be increased

> iteration time only has a cost during boot (persistence unlock). I
> agree that spending extra cycles at boot is worthwhile.

Agreed. For the Live system use case, tuning the number of iterations
based on the speed of the machine where the LUKS device is initially
created doesn't make much sense. IMO, ideally we would fix the
iteration *count* ourselves.

However, cryptsetup only supports setting the iteration *time*
(with --iter-time), so next step would be to ensure there's a wishlist
ticket in cryptsetup bug tracker to request a --iter-count or
similar option.

Now, this won't be enough. UDisks' PartitionCreate that we're using
(and that in turn calls FilesystemCreate) doesn't support passing any
specific option to cryptsetup. UDisks2 (that I'm going to port
tails-persistence-setup to next months) similarly doesn't seem to
support that in the org.freedesktop.UDisks2.Block's Format method.
So another next step is to ensure there's a wishlist ticket in UDisks2
bug tracker about it. Not sure what the best interface would be, and
I suspect that a simple list of arbitrary cryptsetup options would be
hard to support (they may conflict with options UDisks2 passes
itself), so perhaps adding support for encrypt.iteration-count (once
cryptsetup supports this), akin to the existing encrypt.passphrase
opion, would be best.

Anyone interested in engaging with cryptsetup and/or UDisks2 upstream
about this?

Cheers,
--
intrigeri