{"action":"created","issue":{"url":"https://api.github.com/repos/rear/rear/issues/1493","repository_url":"https://api.github.com/repos/rear/rear","labels_url":"https://api.github.com/repos/rear/rear/issues/1493/labels{/name}","comments_url":"https://api.github.com/repos/rear/rear/issues/1493/comments","events_url":"https://api.github.com/repos/rear/rear/issues/1493/events","html_url":"https://github.com/rear/rear/pull/1493","id":257974049,"number":1493,"title":"Improve cryptographic security and user-friendliness for LUKS volumes","user":{"login":"OliverO2","id":4660803,"avatar_url":"https://avatars3.githubusercontent.com/u/4660803?v=4","gravatar_id":"","url":"https://api.github.com/users/OliverO2","html_url":"https://github.com/OliverO2","followers_url":"https://api.github.com/users/OliverO2/followers","following_url":"https://api.github.com/users/OliverO2/following{/other_user}","gists_url":"https://api.github.com/users/OliverO2/gists{/gist_id}","starred_url":"https://api.github.com/users/OliverO2/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/OliverO2/subscriptions","organizations_url":"https://api.github.com/users/OliverO2/orgs","repos_url":"https://api.github.com/users/OliverO2/repos","events_url":"https://api.github.com/users/OliverO2/events{/privacy}","received_events_url":"https://api.github.com/users/OliverO2/received_events","type":"User","site_admin":false},"labels":[{"id":1741281,"url":"https://api.github.com/repos/rear/rear/labels/enhancement","name":"enhancement","color":"0000ff","default":true}],"state":"open","locked":false,"assignee":{"login":"gozora","id":12116358,"avatar_url":"https://avatars3.githubusercontent.com/u/12116358?v=4","gravatar_id":"","url":"https://api.github.com/users/gozora","html_url":"https://github.com/gozora","followers_url":"https://api.github.com/users/gozora/followers","following_url":"https://api.github.com/users/gozora/following{/other_user}","gists_url":"https://api.github.com/users/gozora/gists{/gist_id}","starred_url":"https://api.github.com/users/gozora/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gozora/subscriptions","organizations_url":"https://api.github.com/users/gozora/orgs","repos_url":"https://api.github.com/users/gozora/repos","events_url":"https://api.github.com/users/gozora/events{/privacy}","received_events_url":"https://api.github.com/users/gozora/received_events","type":"User","site_admin":false},"assignees":[{"login":"gozora","id":12116358,"avatar_url":"https://avatars3.githubusercontent.com/u/12116358?v=4","gravatar_id":"","url":"https://api.github.com/users/gozora","html_url":"https://github.com/gozora","followers_url":"https://api.github.com/users/gozora/followers","following_url":"https://api.github.com/users/gozora/following{/other_user}","gists_url":"https://api.github.com/users/gozora/gists{/gist_id}","starred_url":"https://api.github.com/users/gozora/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gozora/subscriptions","organizations_url":"https://api.github.com/users/gozora/orgs","repos_url":"https://api.github.com/users/gozora/repos","events_url":"https://api.github.com/users/gozora/events{/privacy}","received_events_url":"https://api.github.com/users/gozora/received_events","type":"User","site_admin":false}],"milestone":null,"comments":1,"created_at":"2017-09-15T09:07:56Z","updated_at":"2017-09-15T09:44:29Z","closed_at":null,"author_association":"CONTRIBUTOR","pull_request":{"url":"https://api.github.com/repos/rear/rear/pulls/1493","html_url":"https://github.com/rear/rear/pull/1493","diff_url":"https://github.com/rear/rear/pull/1493.diff","patch_url":"https://github.com/rear/rear/pull/1493.patch"},"body":"#### Problem\r\n\r\nReaR 2.2 with cryptsetup 1.6.6 (as on Ubuntu 16.04.3 LTS) uses compiled-in default values which are not up-to-date in terms of cryptographic security:\r\n\r\nOption | cryptsetup 1.6.6 Default | More Secure | Auto-detectable\r\n-------|--------------------------|-------------|----------------\r\nKey size | --key-size 256 | --key-size 512 | Yes\r\nPassphrase processing time (msecs) | --iter-time 1000 | --iter-time 2000 | No\r\nRandom number generation device | --use-urandom | --use-random | No\r\n\r\nFor details, see [Encryption options for LUKS mode](https://wiki.archlinux.org/index.php/Dm-crypt/Device_encryption#Encryption_options_for_LUKS_mode) in the ArchWiki.\r\n\r\nIn addition, ReaR can neither auto-detect nor use existing keyfiles for the automatic decryption of recreated LUKS volumes. A recovered system will ask the user for a passphrase where the original system would not.\r\n\r\n\r\n#### Solution\r\n\r\nThis PR improves LUKS recovery with these characteristics:\r\n* Auto-detect the `--key-size` option from the original volume.\r\n* Auto-detect keyfiles in [crypttab](http://manpages.ubuntu.com/manpages/xenial/en/man5/crypttab.5.html) and add them to recreated LUKS volumes.\r\n* Allow additional cryptsetup options, which cannot be auto-detected, to be configured.\r\n\r\n#### Strategy\r\n\r\nSee comment in commit c9e7e1bdc5a788590e3a378839fbc6e099158a04.\r\n\r\nNote: Removing the documented `mode` option is an incompatible change, which simplifies the code by processing each option in the same way. Since `disklayout.conf` is usually re-generated before being edited, introducing this change seems OK to me.\r\n\r\nTested on Ubuntu 16.04.3 LTS."},"comment":{"url":"https://api.github.com/repos/rear/rear/issues/comments/329734844","html_url":"https://github.com/rear/rear/pull/1493#issuecomment-329734844","issue_url":"https://api.github.com/repos/rear/rear/issues/1493","id":329734844,"user":{"login":"jsmeix","id":1788608,"avatar_url":"https://avatars0.githubusercontent.com/u/1788608?v=4","gravatar_id":"","url":"https://api.github.com/users/jsmeix","html_url":"https://github.com/jsmeix","followers_url":"https://api.github.com/users/jsmeix/followers","following_url":"https://api.github.com/users/jsmeix/following{/other_user}","gists_url":"https://api.github.com/users/jsmeix/gists{/gist_id}","starred_url":"https://api.github.com/users/jsmeix/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jsmeix/subscriptions","organizations_url":"https://api.github.com/users/jsmeix/orgs","repos_url":"https://api.github.com/users/jsmeix/repos","events_url":"https://api.github.com/users/jsmeix/events{/privacy}","received_events_url":"https://api.github.com/users/jsmeix/received_events","type":"User","site_admin":false},"created_at":"2017-09-15T09:44:29Z","updated_at":"2017-09-15T09:44:29Z","author_association":"CONTRIBUTOR","body":"@OliverO2 \r\nas far as I see in your commants in your\r\nusr/share/rear/finalize/GNU/Linux/240_reassign_luks_keyfiles.sh\r\n<pre>\r\noriginal keyfiles should have been restored from the backup\r\n</pre>\r\nit means that with this pull request nothing secret\r\nwill be added into the ReaR recovery system?\r\nAt least not by default without an explicit user setting?\r\nCf.\r\nhttps://github.com/rear/rear/pull/1472#issuecomment-328459748\r\nand\r\nhttps://github.com/rear/rear/issues/1444#issuecomment-324294539\r\n"}}
{"actor":{"display_login":"jsmeix"}}