SCARY: USB Live opens Luks encrypted ssd partition?

[bartatgithub]

Dear all

New here and immediately encountering what I consider to be a problematic issue.

It is unclear how this is possible and whether it is normal; a newly created Parrot 7 USB Live (non-persistent) automatically decrypt (opens) the Parrot 7 btrfs LUKS encrypted / (root) of my laptop (with secureboot on) at boot time without knowing the password and without asking for and entering the password.

I double-checked by:

• shutdown
• USB Live key remove
• USB Live key reinserting
• USB Live key boot
• Parrot 7 btrfs LUKS encrypted / (root) is decrypted, so open

So the same problem occurred. With other Linux distros on a USB Live key, this does not happen.

How can this Parrot USB Live system retrieve the LUKS password from the efi boot or anywhere else!?

ParrotOS iso in use: Parrot 7 Home
Application used for flashing the iso: rufus
Logs/Terminal output (use pastebin or similar services): /
Screenshots: /

[PalinuroSec]

hello, i have been trying to reproduce it for some days but i couldn't. the system actually requires me the password

are you sure none of your luks slots feature an empty password?

please run sudo cryptsetup luksDump /dev/whavererPartitionItIs and post the content here, but please anonymize the sensible data first (we don't need to look at your digest or salt).

i am no cryptsetup expert, so mine is just an attempt to figure out what happened with you.

if we can't sort it out, we should probably try to escalate the bug to the calamares installer team

[bartatgithub]

Hello, here we go:

$sudo cryptsetup luksDump /dev/nvme0n1p3

LUKS header information for /dev/nvme0n1p3

Version:        1
Cipher name:    aes
Cipher mode:    xts-plain64
Hash spec:      sha256
Payload offset: 4096
MK bits:        512
MK digest:      ****
MK salt:        ****
MK iterations:  379369
UUID:           81668a27-****-****-****-0a58ccdce85b

Key Slot 0: ENABLED
Iterations:             6043664
Salt:                   ****
Key material offset:    8
AF stripes:             4000
Key Slot 1: ENABLED
Iterations:             4301850
Salt:                   ****
Key material offset:    512
AF stripes:             4000
Key Slot 2: DISABLED
Key Slot 3: DISABLED
Key Slot 4: DISABLED
Key Slot 5: DISABLED
Key Slot 6: DISABLED
Key Slot 7: DISABLED

Seams ok, no?
Why does a security os uses LUKS version 1?

[PalinuroSec]

hello, i tried a couple of times with different parameters but i couldn't reproduce.

we use luks1 because GRUB does not support argon2 keys. it supports luks2 but only with PBKDF2 keys, which the calamares installer can't generate right now. we tried to patch it, but calamares does not call the relevant cryptsetup commands on its own, so we can't inject the proper flag, instead it calls the KDE's disk management framework, which does not seem to accept key type parameters as far as i know, so the only way for us to provide luks2 support would be to fork KDE's partition manager, which we don't have the capacity to do at the moment.

what we offer is what the calamares offers by default.

Debian supports luks2 by default but it only allows you to do full disk encryption by leaving the boot partition unencrypted, otherwise if you encrypt the boot folder too (via manual partitioning), you encounter the same error and must add a PBKDF2 key slot.

as far as i know, no other linux distribution does true full disk encryption (including /boot) with luks2 and argon, but we are working hard in that direction. in fact we have already backported grub 2.14 and we plan to support argon2 cryptography before other debian based derivatives do

[bartatgithub]

Thank you for your detailed explanation and sorry for the late reply, I was too busy with the jobs.

LUKS(1) is ok for me, only very slow to open, but the exellent full disk encryption installation for your distro is amazing. And one of the reasons I chose this distro.

In the meantime, I also ran some tests and I suspect that it was the Ventoy USB live that kept track of the password. When I deleted it and tried with a new USB live, the LUKS partition no longer opened automatically.

But in the meantime, I need to continue working, so I installed a completely new Parrot and it's been great so far.

Your forum isn't very active, but perhaps you can help me directly with my other LUKS and partition question:

New installation of 7.1 Home Edition, but I was again unable to connect the separate /home partition from a previous MX installation during this installation. Calamares is a limited installer that can't do much.

What I have now:
1 EFI partition
2 Parrot 7.1 btrfs LUKS(1) with / and /home on 1 partition
3 previous btrfs LUKS2 /home partition

What I want to achieve:
1 EFI partition
2 Parrot 7.1 btrfs LUKS(1) / (root) on 1 partition
3 use previous btrfs LUKS2 /home partition

Uncertainties and questions:

• Can I use LUKS(1) and LUKS2 in same system?
• How can I connect the previous LUKS2 /home partition and open and use it as /home (@home)?

There are many answers on the web that remain unclear and not sure to work, hence my question here.