brute force attack on dm-crypt

[Stefan X]

Hi!
I forgot a password for an dm-crypt encrypted partition and would like
to try to break the encryption by brute force. Therefore I have some
questions.

Are there incompatibilities between old dm-crypt and LUKS or is it
possible to mount an old partition which is encrypted with dm-crypt (no
LUKS!) in an up-to-date distributions?

Tools like John the Ripper are great for cracking hashed passwords. Is
it possible to extract a hash out of a partition which can be used for
such attacks as John the Ripper do? If so, do you have any reference how
to execute this task?

Otherwise, I would need to try to mount the partition with each
potential password which would be quite slow. Do you have any
suggestions how to speed up this process?

Regards
Stefan

[Raphaël Gertz]

Post by Stefan X
Hi!
I forgot a password for an dm-crypt encrypted partition and would like
to try to break the encryption by brute force. Therefore I have some
questions.
Are there incompatibilities between old dm-crypt and LUKS or is it
possible to mount an old partition which is encrypted with dm-crypt (no
LUKS!) in an up-to-date distributions?

Not realy

Post by Stefan X
Tools like John the Ripper are great for cracking hashed passwords. Is
it possible to extract a hash out of a partition which can be used for
such attacks as John the Ripper do? If so, do you have any reference how
to execute this task?

Code yourself a C/C++ programe using john library

Post by Stefan X
Otherwise, I would need to try to mount the partition with each
potential password which would be quite slow. Do you have any
suggestions how to speed up this process?

Do like IBM, user a farm of server and makes them run for 4 month
(ibm did a aes brute force and they completed it in 4month)

To day you the trush i think you loosed everything, better try remember or find
old key.

Luks may have multiple key (7 slot), each one can store a password to decypher
the the master key, try to find the other key.

Anyway luks is designe to crypt the data on a military level, don't ever dream
to break it yourself except if you or someone is real expert in security that
discover a failure in aes or luks design.
The only other way would be to have friend in NSA or company with farmserver
that you can use for month...

Try the dm-crypt mailing list : dm-crypt à saout é de, but it's very unlikely
that you would fin a positive answer to your problem

[Arno Wagner]

Post by Stefan X
Hi!
I forgot a password for an dm-crypt encrypted partition and would like
to try to break the encryption by brute force. Therefore I have some
questions.
Are there incompatibilities between old dm-crypt and LUKS or is it
possible to mount an old partition which is encrypted with dm-crypt (no
LUKS!) in an up-to-date distributions?

LUKS and dm-crypt are two different systems. However there may well
support for dm-crypt in a modern sdistribution.

Post by Stefan X
Tools like John the Ripper are great for cracking hashed passwords. Is
it possible to extract a hash out of a partition which can be used for
such attacks as John the Ripper do? If so, do you have any reference how
to execute this task?

No. dm-crypt does not store a hashed password, encrypted or
otherwise. It directly uses the hash of your passphrase as
encryption key. If you still know what is on the partition, you may
be able to at least do a known-plaintext attack, but the only
thing you can use from John the Ripper is the password generation
scheme. However, since you should have at least some idea what
the password looks like, you would best adapt the password
generation to that.

Post by Stefan X
Otherwise, I would need to try to mount the partition with each
potential password which would be quite slow. Do you have any
suggestions how to speed up this process?

Do cryptsetup and see whether the filesystem looks right using your
own code. No mounting required. Even faster, read a sector with some
known contents into memory and decrypt it there using the algorithm
you used for dm-crypt (likely the default). No further disk access
required.

Arno