| Purpose | |
| ======= | |
| chk_luks_keyslots is a tool that searches the keyslot area of a | |
| LUKS container for positions where entropy is low and hence | |
| there is a high probability of damage from overwrites of parts | |
| of the key-slot with data such as a RAID superblock or a partition | |
| table. | |
| Installation | |
| ============ | |
| 1. Install the version of cryptsetup the tool came with. | |
| 2. Compile with "make" | |
| Manual compile can be done with | |
| gcc -lm -lcryptsetup chk_luks_keyslots.c -o chk_luks_keyslots | |
| Usage | |
| ===== | |
| Call chk_luks_keyslots without arguments for an option summary. | |
| Example of a good keyslot area with keys 0 and 2 in use: | |
| -------------------------------------------------------- | |
| root> ./chk_luks_keyslots /dev/loop0 | |
| parameters (commandline and LUKS header): | |
| sector size: 512 | |
| threshold: 0.900000 | |
| - processing keyslot 0: start: 0x001000 end: 0x020400 | |
| - processing keyslot 1: keyslot not in use | |
| - processing keyslot 2: start: 0x041000 end: 0x060400 | |
| - processing keyslot 3: keyslot not in use | |
| - processing keyslot 4: keyslot not in use | |
| - processing keyslot 5: keyslot not in use | |
| - processing keyslot 6: keyslot not in use | |
| - processing keyslot 7: keyslot not in use | |
| Same example of a fault in slot 2 at offset 0x50000: | |
| ---------------------------------------------------- | |
| root>./chk_luks_keyslots /dev/loop2 | |
| parameters (commandline and LUKS header): | |
| sector size: 512 | |
| threshold: 0.900000 | |
| - processing keyslot 0: start: 0x001000 end: 0x020400 | |
| - processing keyslot 1: keyslot not in use | |
| - processing keyslot 2: start: 0x041000 end: 0x060400 | |
| low entropy at: 0x050000 entropy: 0.549165 | |
| - processing keyslot 3: keyslot not in use | |
| - processing keyslot 4: keyslot not in use | |
| - processing keyslot 5: keyslot not in use | |
| - processing keyslot 6: keyslot not in use | |
| - processing keyslot 7: keyslot not in use | |
| Same as last, but verbose: | |
| -------------------------- | |
| root>./chk_luks_keyslots -v /dev/loop2 | |
| parameters (commandline and LUKS header): | |
| sector size: 512 | |
| threshold: 0.900000 | |
| - processing keyslot 0: start: 0x001000 end: 0x020400 | |
| - processing keyslot 1: keyslot not in use | |
| - processing keyslot 2: start: 0x041000 end: 0x060400 | |
| low entropy at: 0x050000 entropy: 0.549165 | |
| Binary dump: | |
| 0x050000 54 68 69 73 20 69 73 20 61 20 74 65 73 74 2D 73 This is a test-s | |
| 0x050010 65 63 74 6F 72 20 66 6F 72 20 63 68 6B 5F 6C 75 ector for chk_lu | |
| 0x050020 6B 73 5F 6B 65 79 73 6C 6F 74 73 20 74 68 65 20 ks_keyslots the | |
| 0x050030 71 75 69 63 6B 20 62 72 6F 77 6E 20 66 6F 78 20 quick brown fox | |
| 0x050040 6A 75 6D 70 73 20 6F 76 65 72 20 74 68 65 20 6C jumps over the l | |
| 0x050050 61 7A 79 20 64 6F 67 20 74 68 65 20 71 75 69 63 azy dog the quic | |
| 0x050060 6B 20 62 72 6F 77 6E 20 66 6F 78 20 6A 75 6D 70 k brown fox jump | |
| 0x050070 73 20 6F 76 65 72 20 74 68 65 20 6C 61 7A 79 20 s over the lazy | |
| 0x050080 64 6F 67 20 74 68 65 20 71 75 69 63 6B 20 62 72 dog the quick br | |
| 0x050090 6F 77 6E 20 66 6F 78 20 6A 75 6D 70 73 20 6F 76 own fox jumps ov | |
| 0x0500a0 65 72 20 74 68 65 20 6C 61 7A 79 20 64 6F 67 20 er the lazy dog | |
| 0x0500b0 74 68 65 20 71 75 69 63 6B 20 62 72 6F 77 6E 20 the quick brown | |
| 0x0500c0 66 6F 78 20 6A 75 6D 70 73 20 6F 76 65 72 20 74 fox jumps over t | |
| 0x0500d0 68 65 20 6C 61 7A 79 20 64 6F 67 20 74 68 65 20 he lazy dog the | |
| 0x0500e0 71 75 69 63 6B 20 62 72 6F 77 6E 20 66 6F 78 20 quick brown fox | |
| 0x0500f0 6A 75 6D 70 73 20 6F 76 65 72 20 74 68 65 20 6C jumps over the l | |
| 0x050100 61 7A 79 20 64 6F 67 20 74 68 65 20 71 75 69 63 azy dog the quic | |
| 0x050110 6B 20 62 72 6F 77 6E 20 66 6F 78 20 6A 75 6D 70 k brown fox jump | |
| 0x050120 73 20 6F 76 65 72 20 74 68 65 20 6C 61 7A 79 20 s over the lazy | |
| 0x050130 64 6F 67 20 74 68 65 20 71 75 69 63 6B 20 62 72 dog the quick br | |
| 0x050140 6F 77 6E 20 66 6F 78 20 6A 75 6D 70 73 20 6F 76 own fox jumps ov | |
| 0x050150 65 72 20 74 68 65 20 6C 61 7A 79 20 64 6F 67 20 er the lazy dog | |
| 0x050160 74 68 65 20 71 75 69 63 6B 20 62 72 6F 77 6E 20 the quick brown | |
| 0x050170 66 6F 78 20 6A 75 6D 70 73 20 6F 76 65 72 20 74 fox jumps over t | |
| 0x050180 68 65 20 6C 61 7A 79 20 64 6F 67 20 74 68 65 20 he lazy dog the | |
| 0x050190 71 75 69 63 6B 20 62 72 6F 77 6E 20 66 6F 78 20 quick brown fox | |
| 0x0501a0 6A 75 6D 70 73 20 6F 76 65 72 20 74 68 65 20 6C jumps over the l | |
| 0x0501b0 61 7A 79 20 64 6F 67 20 74 68 65 20 71 75 69 63 azy dog the quic | |
| 0x0501c0 6B 20 62 72 6F 77 6E 20 66 6F 78 20 6A 75 6D 70 k brown fox jump | |
| 0x0501d0 73 20 6F 76 65 72 20 74 68 65 20 6C 61 7A 79 20 s over the lazy | |
| 0x0501e0 64 6F 67 20 74 68 65 20 71 75 69 63 6B 20 62 72 dog the quick br | |
| 0x0501f0 6F 77 6E 20 66 6F 78 20 6A 75 6D 70 73 20 6F 76 own fox jumps ov | |
| - processing keyslot 3: keyslot not in use | |
| - processing keyslot 4: keyslot not in use | |
| - processing keyslot 5: keyslot not in use | |
| - processing keyslot 6: keyslot not in use | |
| - processing keyslot 7: keyslot not in use | |
| ---- | |
| Copyright (C) 2012, Arno Wagner <arno@wagner.name> | |
| This file is free documentation; the author gives | |
| unlimited permission to copy, distribute and modify it. |