Kudelski Security, a company specializing in security audits, has released the Shufflecake toolkit, which allows for the creation of hidden file systems that are spread across available free space in existing partitions and indistinguishable from random residual data. The partitions are created in such a way that, without the access key, proving their existence is problematic, even during forensic analysis. The code for the utilities (shufflecake-userland) and the Linux kernel module (dm-sflc) is written in C and released under the GPLv3 license, which makes it impossible to include the published kernel module in the main kernel due to incompatibility with the GPLv2 license under which the kernel is distributed.
The project is positioned as a more advanced solution than Truecrypt and Veracrypt for hiding sensitive data, which has native support for the Linux platform and allows for the placement of up to 15 hidden partitions on a device, nested within each other to obscure their existence. While the application of Shufflecake itself is not a secret, as can be judged by the presence of the corresponding utilities in the system, the overall number of created hidden partitions cannot be determined. The hidden partitions can be formatted at the user's discretion to accommodate any file systems, such as ext4, xfs, or btrfs. Each partition is treated as a separate virtual block device with its own unlock key.
To obfuscate traces, a behavior model of 'plausible deniability' is suggested, the essence of which is that valuable data is hidden as additional layers within encrypted partitions containing less valuable data, forming a sort of hidden hierarchy of partitions. In case of pressure, the device owner can reveal the key to the encrypted partition, but within this partition, other partitions may be hidden (up to 15 nested levels), and determining their presence and proving their existence is challenging.
Hiding is achieved by forming each section as a set of encrypted slices that are placed in random positions on the storage device. Each slice is created dynamically when additional storage space is required within the section. To complicate analysis, slices from different sections are interspersed, i.e., Shufflecake sections are not linked to contiguous areas and slices from all sections are mixed together. Information about the used and free slices is stored in a location map associated with each section, which is referenced by the encrypted header. Both the maps and the header are encrypted and are indistinguishable from random data without knowledge of the access key.
The header is divided into slots, each of which defines its section and associated slices. Slots in the header are arranged in a stack order and are recursively linked—the current slot contains the key for decrypting the parameters of the previous (less hidden) section in the hierarchy, allowing the use of a single password to decrypt all less hidden sections related to the selected section. Each less hidden section treats the slices of nested sections as free.
By default, all nested Shufflecake sections have the same visible size as the top-level section. For example, if a 1 GB device has three sections, each will be visible to the system as a section with a size of 1 GB, and the total available disk space will be shared across all sections—if the cumulative size of the stored data exceeds the actual device size, an input/output error will begin to occur.
Unopened nested sections do not participate in space distribution, meaning that attempting to fill a top-level section will overwrite data in nested sections without revealing their presence through data size analysis that could fit in the section before an error is triggered (it is assumed that top-level sections contain immutable data to distract attention and are never used individually, while regular operations always occur with the most recently nested section; the scheme implies that it is more important to maintain the secrecy of data existence than to lose that data).
Fifteen Shufflecake sections are almost always created — used sections are tied to a user's password, while unused sections are assigned a randomly generated password (it is impossible to determine how many sections are actually in use). When initializing Shufflecake sections, the assigned disk, partition, or virtual block device is filled with random data, making it impossible to distinguish Shufflecake metadata and data against the general background.
The Shufflecake implementation offers quite high performance, but due to overhead, it has about half the throughput compared to disk encryption based on the LUKS subsystem. Using Shufflecake also incurs additional memory and storage costs for auxiliary data on the disk. Memory costs are estimated at 60 MB per section, while disk space costs amount to 1% of the total size. In comparison, a similar technique called WORAM leads to a slowdown of 5 to 200 times with a 75% loss of usable disk space.
The toolkit and kernel module have only been tested on Debian and Ubuntu with kernels 5.13 and 5.15 (support for Ubuntu 22.04 is provided). It is noted that the project should currently be regarded as a working prototype that should not be used for storing important data. Future plans include further optimization of performance, reliability, and security, as well as providing the ability to boot from Shufflecake partitions.
Source: opennet.ru
