Re: [Tails-testers] Veracrypt PIM and PKCS in Tails

Delete this message

Reply to this message
Author: segfault
Date:  
To: tails-testers, sajolida
Subject: Re: [Tails-testers] Veracrypt PIM and PKCS in Tails
sajolida:
> segfault:
>> Hi,
>>
>> Alan Hiew:
>>> I tried to use Tails Betta with Veracrypt support. But I couldn't mount
>>> a hidden Veracrypt volume with specified Volume PIM and PKCS-5 PRF.
>>
>> Specifying the PIM will only be supported in Tails 4.0. If you are
>> interested in the details: The PIM setting is only supported in
>> cryptsetup since cryptsetup version 2.0. Tails is currently based on
>> Debian Stretch, which ships cryptsetup 1.7.3. So the PIM will be
>> supported when Tails is based on Debian Buster (i.e. Tails 4.0).
>>
>>> In Veracrypt itself I can mount it, but in VeraCrypt integrated in
>>> Tails is no Volume PIM and PKCS-5 PRF options. And volume created with
>>> these can't be unlocked by correct password only...
>>
>> Yes, I'm sorry that you won't be able to use the new VeraCrypt support
>> with your volume until Tails 4.0.
>
> I didn't know that!


See https://labs.riseup.net/code/issues/15630

> I guess it still makes sense to upstream the PIM support in GNOME and
> that we can't have a special treatment for that in the code in Tails.
>
> Still, the least we could do is to mention this limitation in the doc as
> I expect it to become a frequent question to our help desk. After all,
> our UI pretends that it works...


The GNOME Shell dialog shows the PIM field, but displays an error
message if it is used. I don't think there is a way to test in GNOME
Shell whether cryptsetup/udisks supports the PIM.

> So shall I add a "bug" section to the "Unlocking parameters" section of
> the doc saying that PIM will only be supported in Tails 4.0?


A not would be good. Not sure if it qualifies as a bug, but I'll let you
decide how you think it should be presented in the doc.