linux-kernel - Re: [GIT PULL] fscrypt updates for 4.18

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <30587992.7Od65ROsjm@blindfold>
Date:   Tue, 05 Jun 2018 18:10:24 +0200
From:   Richard Weinberger <richard@...ma-star.at>
To:     "Theodore Y. Ts'o" <tytso@....edu>
Cc:     Richard Weinberger <richard.weinberger@...il.com>,
        Linus Torvalds <torvalds@...ux-foundation.org>,
        LKML <linux-kernel@...r.kernel.org>,
        linux-fscrypt@...r.kernel.org
Subject: Re: [GIT PULL] fscrypt updates for 4.18

Am Dienstag, 5. Juni 2018, 17:35:01 CEST schrieb Theodore Y. Ts'o:
> On Tue, Jun 05, 2018 at 05:13:35PM +0200, Richard Weinberger wrote:
> > > Add bunch of cleanups, and add support for the Speck128/256
> > > algorithms.  Yes, Speck is contrversial, but the intention is to use
> > > them only for the lowest end Android devices, where the alternative
> > > *really* is no encryption at all for data stored at rest.
> > 
> > Will Android tell me that Speck is being used?
> 
> Well, today Android doesn't tell you, "Your files aren't being
> encrypted" in some big dialog box.  :-)  
> 
> Whether a phone is using no encryption or not, and what encryption
> algorithm, is fundamentally a property of the phone.  It's used to
> encrypt data at rest on the phone, so this isn't a data interchange
> issue.  I'm sure there will be some way of finding out --- by looking
> at the source code for that phone, if nothing else.
> 
> But I suspect that if you are buying a phone in a first world country,
> you're never going to see a phone with Speck on it --- unless you
> build your own AOSP build and deliberately enable it for yourself,
> anyway.  :-)

That's the question. I understand the use case, but I fear attack scenarios
where someone manages to downgrade the crypto of my phone.
This is why I was asking whether Android tells me whether Speck is used or not.
"it does encryption" is clearly not enough.

Thanks,
//richard

P.s. Sorry for hijacking this PR. :-)

-- 
sigma star gmbh - Eduard-Bodem-Gasse 6 - 6020 Innsbruck - Austria
ATU66964118 - FN 374287y