Does the presence of cleartext sha1 sums in knoppix-data.aes indicate corruption?
2
votes
1
answer
66
views
This question is about the optional encryption of user data with the live Linux distribution KNOPPIX v6.2 (2009-11-18), which as I understand is based on Debian.
I do not use this old version anymore, but I am trying to retrieve years-old data from the persisted data file **knoppix-data.aes** created by KNOPPIX v6.2 in the startup prompts. The file is one byte less than 4 GiB.
I was hoping someone who knows about Linux encryption standards going back to the late 2000s might be able to provide some information about this file (as I shall explain below). I'm not very familiar with Linux encryption standards, and am a bit overwhelmed by the myriad of terms I see (like "LUKS", "dm-crypt", etc.) -- I'm not certain which, if any, applies to my situation with late 2000s Knoppix.
Obviously the ".aes" in the file name indicates AES encryption. At first I suspected I was typing the password incorrectly, but now I wonder if there might be another issue that would render my attempts to correctly type the password futile. I will explain:
When I view the file with a hex editor, it's surprising to see that the beginning of the file is a cleartext list of file names and hashes, e.g.:
f4374a5897aafd09a2439f6c3f4a961d5cc7c1a1 *autorun.bat
eaf953dce8de1442e4e32769260e22435a70f3bc *autorun.inf
(etc.)
(also included are hashes for many files that obviously relate to Knoppix, such as **KNOPPIX/knoppix-logo-small.png**, to give one example)
The beginning bytes seems to match exactly with the plaintext file **/mnt-system/KNOPPIX/sha1sums** (on the USB drive where Knoppix is installed, so it's apparently part of the Knoppix installation). After that there are expanses of null bytes (00), and then random gibberish. I was expecting the entire thing would be random gibberish; in the context of AES encryption, the cleartext at the beginning of the ".aes" file would seem to be incongruous.
As a test, I powered off, renamed the original AES file, and then rebooted and created another **knoppix-data.aes** that is 256 MiB, with password "123456789". This one does not contain the cleartext at the beginning, and I am able to write to it (and successfully decrypt it on subsequent boots).
But I don't know about this opaque file format (or where the documentation for it is), other than it (presumably) involves an AES algorithm (but I have no details about mode of operation, key derivation, header, etc.). In particular, is it normal to have this cleartext stuff (sha hashes and file names) at the beginning of the file, as some kind of header, perhaps? Or would it indicate that the file has somehow become corrupted (such as by being concatenated with the **sha1sums** file in some bizarre circumstances)?
If the answer is that it's normal for the cleartext sha1 sums to be there, does that mean I need to provide an offset to **losetup** to move past the cleartext? I'm currently using
echo "mypassword" | losetup -p 0 -e aes -k 256 /dev/loop2 knoppix-data.aes
mount /dev/loop2 /media/mydir/
to avoid having to reboot every time I want to attempt decryption. This works for the 256 MiB test version of **knoppix-data.aes**, with password "123456789" and with no cleartext at the beginning, but not for the original 4 GiB file that has the cleartext hashes (it complains about the file system not being specified, which presumably means that it cannot be automatically determined, which presumably means that the decryption produced gibberish rather than the desired data, possibly because the cleartext is not supposed to be there, or because **losetup** needs an offset to move past it).
Asked by Keith
(23 rep)
Jun 25, 2019, 09:52 AM
Last activity: Jun 25, 2019, 10:37 AM
Last activity: Jun 25, 2019, 10:37 AM