On 23 Oct 2023 12:53 +0200, from leste...@gazeta.pl (lester29): > 1. Does an encryption key on the USB protect against rubber-hose > cryptanalysis?
I don't see how it would. Presumably you would have access to it; therefore that access could potentially be exploited through coercion or torture. https://en.wikipedia.org/wiki/Rubber-hose_cryptanalysis It does however make some _other_ types of attacks more difficult; evil maid, video capture of typing in the passphrase, etc. might not be thwarted completely, but would increase the complexity. > 2. Is it true that key on pendrive is more risky than password because > someone can steal the usb key and access data without the need of password? It can be true. It can also be false. LUKS offers the concept of "detached header", in which case everything works exactly as it would with the header on the encrypted storage device, except that the header itself is _stored_ elsewhere. That header can still be protected by a weak password or a strong passphrase, which itself can be stored either electronically, on paper, or strictly in one's brain. It's not quite as simple as "one is more secure than the other". One advantage of keeping something needed to unlock a container on a physical device which one keeps with them is that you can _know_ that no unauthorized person has been able to gain access to it. The disadvantage is in the case of loss of or damage to that device, so you'd normally want to keep a copy somewhere else, but that compromises the access restriction guarantees. _As a general rule, before implementing any security mechanism, it's a good idea to actually determine what you are trying to protect against by doing so._ The term for this is _threat modeling_. As a very simplistic example, there's little point in getting high-grade locks for your home if you always leave the ground floor windows open when you leave for work for the day; for the locks to do much of any good, you'd also need to start closing the windows. > 3. What do you think about simply encrypting the disk with LUKS and do > encrypted backups? It's what I do, and it's what I recommend that people do unless they have some very specific reason not to. You can lose a _little_ bit of I/O throughput, but with modern-day CPUs and storage devices, including high-speed NVMe SSDs, with perhaps the exception of striped high-speed storage, the performance loss should be largely negligible. -- Michael Kjörling 🔗 https://michael.kjorling.se “Remember when, on the Internet, nobody cared that you were a dog?”
