en	[[!meta title="Weak cryptographic parameters in LUKS1"]]

en	[[!tag security/fixed]]

en	The cryptographic parameters of LUKS from Tails 5.12 or earlier are weak against a state-sponsored attacker with physical access to your device.

en	**We recommend you change the passphrase of your Persistent Storage and other LUKS encrypted volumes unless you use a long passphrase of 5 random words or more.**

en	[[!toc levels=2]]

en	Understanding the weakness and its solution

en	The arms race to protect from brute-force attacks

en	In all encryption technology that protects data on a disk or USB stick with a password or a passphrase, an attacker can try all possible combinations until they guess your passphrase and unlock the encryption. This type of attack is called a *[[!wikipedia brute-force attack]]*.

en	A strong password makes brute-force attacks slower and more expensive. The longer the passphrase, the more expensive the brute-force attack becomes.

en	Some cryptographic parameters can also make each guess of a brute-force attack slower and more expensive, for example by having to do some complicated calculations on each passphrase before being able to try to unlock the encryption with the result of this calculation.

en	Over the years, computers become faster and cheaper. Encryption technologies regularly upgrade their parameters to find a balance between making encryption fast and usable by users while making brute-force attacks as expensive as possible for attackers.

en	Strong encryption parameters *combined* with a strong passphrase make brute-force attacks so slow and so expensive that they are impossible to do in practice. For example, a brute-force attack is impossible to do in practice if it would take thousands of years even with the most powerful supercomputers.

en	Strength of Argon2id compared to PBKDF2

en	Until Tails 5.12 (19 April 2023), Tails created LUKS devices version 1 (LUKS1) with PBKDF2 as *key derivation function*, a calculation run on the passphrase before trying to unlock the encryption with the result.

en	PBKDF2 is now considered too weak compared to available computing power.

en	Some cryptographers think this weakness might have already been [used against an activist in France](https://mjg59.dreamwidth.org/66429.html) but the actual operations by the French police are kept secret.

en	Since Tails 5.13 (16 May 2023), Tails creates LUKS devices version 2 (LUKS2) with Argon2id as *key derivation function*.

en	Tails versionwhen encryption was createdRelease dateLUKS versionKey derivation functionStrength 5.12 or earlier19 April 2023LUKS1PBKDF2Weak 5.13 or later16 May 2023LUKS2Argon2idStrong

en	We estimated how much electricity it would cost to guess passphrases of different strengths. As we recommend for the Persistent Storage, we evaluated passphrases made of several random words.

en	Passphrase lengthPBKDF2Argon2id 3 random words$0.1$100 4 random words$1 000$1 000 000 5 random words$10 000 000$10 000 000 000 6 random words$100 000 000 000$100 000 000 000 000 7 random words$1 000 000 000 000 000$1 000 000 000 000 000 000

en	These numbers are very rough estimates but give an idea of what length of passphrase a very powerful adversary like a state-sponsored attacker could guess.

en	Even if guessing a passphrase of 3 random words with LUKS1 costs very little energy, any such attack also requires:

en	Physical access to the device

en	Very expensive computer equipment

en	Professional hacking skills

en	You can see the details of our calculations in [[!tails_ticket 19615]] and this [spreadsheet](https://cryptpad.disroot.org/sheet/#/2/sheet/view/KdOJLeuCsc4dS3vq-bHhFw6zByUSRJXsCcAkB-ERxtc/).

en	Other password schemes give too little guarantee

en	We recommend using passphrases made of several random words because using randomness is the only way to really guarantee the strength of a password.

en	Using other password schemes give little guarantee over the strength of a password, even if it follows complicated password policies and validates on password strength meters.

en	For example, a [Dutch hacker logged into Donald Trump's Twitter account *twice*](https://www.washingtonpost.com/world/2020/12/17/dutch-trump-twitter-password-hack/) by guessing his passwords, despite that these passwords included several words, were more than 8 characters, and even had special characters. They were definitely not random enough: "*maga2020!*" and "*yourefired*".

en	To understand the maths behind password strength, watch [An information theoretic model of privacy and security metrics](https://media.libreplanet.org/u/libreplanet/m/an-information-theoretic-model-of-privacy-and-security-metrics/). Bill Budington from the EFF explains the concept of entropy and its implication on browser fingerprinting and password safety in accessible terms.

en	Keeping your encryption secure

en	All users are recommended to upgrade to LUKS2 on all their encrypted devices: Persistent Storage, backup Tails, and other external encrypted volumes.

en	Depending on the strength of your passphrase, we might also recommend choosing a different passphrase and migrating to another Tails USB stick:

en	[[If your passphrase has 4 random words or fewer|argon2id#4]]

en	[[If your passphrase has 5 random words|argon2id#5]]

en	[[If your passphrase has 6 random words or more|argon2id#6]]

en	If your passphrase has 4 random words or fewer

en	If your current passphrase has 4 random words or fewer:

en	Your encryption is insecure with LUKS1.

en	You have to upgrade to LUKS2.

en	Your encryption is more secure with LUKS2.

en	We still recommend changing your passphrase to be 5 random words or more.

en	Persistent Storage (4 words or fewer)

en	To secure your Persistent Storage:

en	Update to Tails 5.14.

en	When starting Tails 5.14 for the first time, Tails will automatically convert your Persistent Storage to LUKS2.

en	Choose a new passphrase of 5 to 7 random words.

en	[[!toggle id="4_ps_keepassxc" text="Display the instructions to generate a passphrase using *KeePassXC*."]]

en	[[!toggleable id="4_ps_keepassxc" text="""

en	[[!inline pages="security/argon2id/keepassxc.inline" raw="yes" sort="age"]]

en	Change your passphrase.

en	[[!toggle id="4_ps_passphrase" text="Display the instructions to change the passphrase of your Persistent Storage."]]

en	[[!toggleable id="4_ps_passphrase" text="""

en	[[!inline pages="security/argon2id/ps_passphrase.inline" raw="yes" sort="age"]]

en	If you created your Persistent Storage with Tails 5.12 or earlier, we recommend you migrate your entire Tails to a different USB stick and destroy your old Tails USB stick (or at least [[securely delete the entire device|doc/encryption_and_privacy/secure_deletion#device]]).

en	If you don't, the previous LUKS1 data might still be written in some recovery data on the USB stick and could be recovered using advanced data forensics techniques.

en	[[!toggle id="4_ps_tails_installer" text="Display the instructions to migrate your Tails to a new USB stick."]]

en	[[!toggleable id="4_ps_tails_installer" text="""

en	[[!inline pages="security/argon2id/tails_installer.inline" raw="yes" sort="age"]]

en	Backup Tails (4 words or fewer)

en	To secure your [[backup Tails|doc/persistent_storage/backup]], if you have one:

en	Start on your main Tails USB stick.

en	Update your main Tails USB stick to Tails 5.14.

en	Create a new backup Tails using *Tails Cloner*

en	If you created your Persistent Storage with Tails 5.12 or earlier, we recommend you create your new backup Tails on a different USB stick and destroy your old backup Tails (or at least [[securely delete the entire device|doc/encryption_and_privacy/secure_deletion#device]]).

en	[[!toggle id="4_backup_tails_installer" text="Display the instructions to create a new backup."]]

en	[[!toggleable id="4_backup_tails_installer" text="""

en	Other encrypted volumes (4 words or fewer)

en	To secure your other encrypted volumes, if you have any:

en	[[!toggle id="4_other_keepassxc" text="Display the instructions to generate a passphrase using *KeePassXC*."]]

en	[[!toggleable id="4_other_keepassxc" text="""

en	If your encrypted volume is on a traditional hard disk (not an SSD) and you can use the command line:

en	Identify the partition name of your encrypted volume.

en	[[!toggle id="4_other_cryptsetup_partition" text="Display the instructions to identify the partition name using the command line."]]

en	[[!toggleable id="4_other_cryptsetup_partition" text="""

en	[[!inline pages="security/argon2id/cryptsetup_partition.inline" raw="yes" sort="age"]]

en	If you created your encrypted volume with Tails 5.12 or earlier, upgrade to LUKS2.

en	[[!toggle id="4_other_cryptsetup_upgrade" text="Display the instructions to upgrade to LUKS2 using the command line."]]

en	[[!toggleable id="4_other_cryptsetup_upgrade" text="""

en	[[!inline pages="security/argon2id/cryptsetup_upgrade.inline" raw="yes" sort="age"]]

en	[[!toggle id="4_other_cryptsetup_passphrase" text="Display the instructions to change your passphrase using the command line."]]

en	[[!toggleable id="4_other_cryptsetup_passphrase" text="""

en	[[!inline pages="security/argon2id/cryptsetup_passphrase.inline" raw="yes" sort="age"]]

en	Otherwise, if your encrypted volume is on a USB stick (or an SSD) or you are not comfortable with the command line:

en	If you created your encrypted volume with Tails 5.13 or later, we recommend you change your passphrase.

en	Follow our instructions on [[changing the passphrase of an existing encrypted partition|doc/encryption_and_privacy/encrypted_volumes#changing]].

en	If you created your encrypted volume with Tails 5.12 or earlier, we recommend you migrate all your encrypted data to a new encrypted device.

en	Follow our instructions on [[creating and using LUKS encrypted volumes|doc/encryption_and_privacy/encrypted_volumes]].

en	We also recommend you destroy your old device (or at least [[securely delete the entire device|doc/encryption_and_privacy/secure_deletion#device]]).

en	If you don't, the previous LUKS1 data might still be written in some recovery data on the USB stick and could be recovered using advanced data forensics techniques.

en	If your passphrase has 5 random words

en	If your current passphrase has 5 random words:

en	Your encryption is secure with LUKS1, except against a very powerful adversary, like a state-sponsored attacker with a huge budget to spend on guessing your passphrase.

en	We still recommend you upgrade to LUKS2.

en	Your encryption is even more secure with LUKS2.

en	Congratulations on following our recommendations!

en	Persistent Storage (5 words)

en	Consider adding another random word to your passphrase.

en	[[!toggle id="5_ps_passphrase" text="Display the instructions to change the passphrase of your Persistent Storage."]]

en	[[!toggleable id="5_ps_passphrase" text="""

en	If you created your encrypted volume with Tails 5.12 or earlier and are worried about a very powerful adversary, consider migrating your entire Tails to a different USB stick and destroying your old Tails USB stick (or at least [[securely deleting the entire device|doc/encryption_and_privacy/secure_deletion#device]]).

en	[[!toggle id="5_ps_tails_installer" text="Display the instructions to migrate your entire Tails to a new USB stick."]]

en	[[!toggleable id="5_ps_tails_installer" text="""

en	Backup Tails (5 words)

en	Update your backup or create a new backup Tails using *Tails Cloner*.

en	If you created your backup Tails with Tails 5.12 or earlier and are worried about a very powerful adversary, consider creating your new backup Tails on a different USB stick and destroying your old backup Tails (or at least [[securely deleting the entire device|doc/encryption_and_privacy/secure_deletion#device]]).

en	[[!toggle id="5_backup_tails_installer" text="Display the instructions to update your backup or create a new backup."]]

en	[[!toggleable id="5_backup_tails_installer" text="""

en	Other encrypted volumes (5 words)

en	If you created your encrypted volume with Tails 5.12 or earlier and your encrypted volume is on a traditional hard disk (not an SSD) and you can use the command line:

en	[[!toggle id="5_other_cryptsetup_partition" text="Display the instructions to identify the partition name using the command line."]]

en	[[!toggleable id="5_other_cryptsetup_partition" text="""

en	[[!toggle id="5_other_cryptsetup_upgrade" text="Display the instructions to upgrade to LUKS2 using the command line."]]

en	[[!toggleable id="5_other_cryptsetup_upgrade" text="""

en	[[!toggle id="5_other_cryptsetup_passphrase" text="Display the instructions to change your passphrase using the command line."]]

en	[[!toggleable id="5_other_cryptsetup_passphrase" text="""

en	If you create your encrypted volume with Tails 5.12 or earlier and your encrypted volume is on a USB stick (or an SSD) or if you are not comfortable with the command line:

en	Migrate all your encrypted data to a new encrypted device.

en	Follow our instructions on [[creating and using LUKS encrypted volumes|doc/encryption_and_privacy/encrypted_volumes]].

en	If you are worried about a very powerful adversary, consider destroying your old device (or at least [[securely deleting the entire device|doc/encryption_and_privacy/secure_deletion#device]]).

en	If your passphrase has 6 random words or more

en	If your current passphrase has 6 random words or more:

en	Your encryption is secure with LUKS1, even against a very powerful adversary.

en	Congratulations on following our most secure recommendations!

en	Persistent Storage (6 words or more)

en	Your Persistent Storage is already secure, even with LUKS1.

en	After you upgrade to Tails 5.14 or later, Tails will automatically convert your Persistent Storage to LUKS2 and make your Persistent Storage even more secure.

en	Backup Tails (6 words or more)

en	Your backup Tails is already secure, even with LUKS1.

en	If you want to upgrade your backup Tails to LUKS2 anyway:

en	Update your backup using *Tails Cloner*.

en	[[!toggle id="6_backup_tails_installer" text="Display the instructions to update your backup."]]

en	[[!toggleable id="6_backup_tails_installer" text="""

en	Other encrypted volumes (6 words or more)

en	Your other encrypted volumes are already secure, even with LUKS1.

en	If you want to upgrade your other encrypted volumes to LUKS2 anyway and you know how to use the command line:

en	[[!toggle id="6_other_cryptsetup_partition" text="Display the instructions to identify the partition name using the command line."]]

en	[[!toggleable id="6_other_cryptsetup_partition" text="""

en	Upgrade to LUKS2.

en	[[!toggle id="6_other_cryptsetup_upgrade" text="Display the instructions to upgrade to LUKS2 using the command line."]]

en	[[!toggleable id="6_other_cryptsetup_upgrade" text="""

en	Knowing which version of LUKS is used in your devices

en	If you know how to use the command line, you can verify whether your encryption uses PBKDF2 or Argon2id.

en	Persistent Storage

en	When starting Tails, [[set up an administration password|doc/first_steps/welcome_screen/administration_password/]].

en	Choose **Applications**&nbsp;▸ **System Tools**&nbsp;▸ **Root Terminal**.

en	Execute the following command:

en	lsblk

en	The output is a list of the storage devices and partitions on the system. For example:

en	NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT loop0 7:0 0 1.2G 1 loop /lib/live/mount/rootfs/filesystem.squashfs sda 8:0 1 7G 0 disk ├─sda1 8:1 1 4G 0 part /lib/live/mount/medium └─sda2 8:2 1 3G 0 part └─TailsData_unlocked 253:0 0 3G 0 crypt /run/nosymfollow/live/persistence/TailsData_un... zram0 254:0 0 2.8G 0 disk [SWAP]

en	Your Persistent Storage appears as `TailsData_unlocked`.

en	Take note of the *partition name* of your Persistent Storage, which appears above `TailsData_unlocked`. In this example, the Persistent Storage is in the partition sda2. Yours might be different.

en	To verify whether your encrypted volume uses PBKDF2 or Argon2id, execute the following command.

en	Replace [partition] with the partition name found in step 4.

en	sudo cryptsetup luksDump /dev/[partition]

en	In the output:

en	`Version` indicates the version of LUKS, either `1` or `2`.

en	`PBKDF` indicates the key derivation function, either `pbkdf2` or `argon2id`.

en	Other encrypted volumes

en	Replace [partition] with the partition name found in step 6.