Security of storing LUKS password inside dom0 in plain text

Want to use the standard LUKS password of my Qubes install also for the Qubes Backup and store it in plaintext inside dom0.

The kicksecure wiki has some good security advice:

But I am still really not sure if this is okay to do.

Does this compromise my security in some way?
I mean the encryption key for the LUKS partition is in RAM anyway?
Or does this really open some new attack vectors?

1 Like

Not really. The passphrase used to unlock the LUKS device is only used to unlock the key used by LUKS. This is why you can have multiple passphrases to unlock your LUKS device, if the passphrase was the key you would not be able to have multiple passphrases, and changing the passphrase would require re-encrypting the whole disk :slight_smile:

The LUKS key is in memory, not your passphrase.

Normally, dom0 should stay unaffected by qubes activities. I think it is safe to store your passphrase on dom0 as long as you did not allow a qube to reach dom0 through a weird custom qrexec script (users can be creative!) and that only you can access the machine physically when it’s unlocked.

This is not really good, but I can’t say it’s bad, you should see how convenient other options are for you and if it’s fine per your threat model.

That’s what I meant is it not called encryption key? Should I have said master key?

BTW how secure is it to leave qubes in xscreenssaver unattended?

I think the best way to do backups is just use the same passphrase from the whole Qubes partition and just create a new LUKS partition on the backup drive and create backups there unencrypted. I think this wouldn’t reduce security at all??

1 Like

It depends on your threat model.

This is not a very useful reply for newbies. Which example threat models are affected by leaving the machine locked?

I can think of someone catching you while your machine is running unlocked, then they will be able to unencrypt all your backups with that passphrase.