[[!meta date="Tue, 14 Jun 2023 12:34:56 -0000"]]

[[!meta title="Weak cryptographic parameters in LUKS1"]]

[[!pagetemplate template="news.tmpl"]]

[[!tag security/fixed]]

The cryptographic parameters of LUKS from Tails 5.12 or earlier are weak against a state-sponsored attacker with physical access to your device.

**We recommend you change the passphrase of your Persistent Storage and other
LUKS encrypted volumes unless you use a long passphrase of 5 random words or
more.**

[[!toc levels=2]]

<h1 id="understanding">Understanding the weakness and its solution</h1>

<h2 id="race">The arms race to protect from brute-force attacks</h2>

In all encryption technology that protects data on a disk or USB stick with a password or a passphrase, an attacker can try all possible combinations until they guess your passphrase and unlock the encryption. This type of attack is called a *[[!wikipedia brute-force attack]]*.

A strong password makes brute-force attacks slower and more expensive. The longer the passphrase, the more expensive the brute-force attack becomes.

Some cryptographic parameters can also make each guess of a brute-force attack slower and more expensive, for example by having to do some complicated calculations on each passphrase before being able to try to unlock the encryption with the result of this calculation.

Over the years, computers become faster and cheaper. Encryption technologies regularly upgrade their parameters to find a balance between making encryption fast and usable by users while making brute-force attacks as expensive as possible for attackers.

Strong encryption parameters *combined* with a strong passphrase make brute-force attacks so slow and so expensive that they are impossible to do in practice. For example, a brute-force attack is impossible to do in practice if it would take thousands of years even with the most powerful supercomputers.

<h2 id="comparison">Strength of Argon2id compared to PBKDF2</h2>

Until Tails 5.12 (19 April 2023), Tails created LUKS devices version 1 (LUKS1) with PBKDF2 as *key derivation function*, a calculation run on the passphrase before trying to unlock the encryption with the result.

PBKDF2 is now considered too weak compared to available computing power.

Some cryptographers think this weakness might have already been [used against an activist in France](https://mjg59.dreamwidth.org/66429.html) but the actual operations by the French police are kept secret.

Since Tails 5.13 (16 May 2023), Tails creates LUKS devices version 2 (LUKS2) with Argon2id as *key derivation function*.

<table>
<tr><th>Tails version<br/>when encryption was created</th><th>Release date</th><th>LUKS version</th><th>Key derivation function</th><th>Strength</th></tr>
<tr><td>5.12 or earlier</td><td>19 April 2023</td><td>LUKS1</td><td>PBKDF2</td><td>Weak</td></tr>
<tr><td>5.13 or later</td><td>16 May 2023</td><td>LUKS2</td><td>Argon2id</td><td>Strong</td></tr>
</table>