Cryptage disque physique sur debian/ubuntu

PASSPHRASE CHARACTER SET: Some people have had difficulties with this when upgrading distributions. It is highly advisable to only use the 95 printable characters from the first 128 characters of the ASCII table, as they will always have the same binary representation. Other characters may have different encoding depending on system configuration and your passphrase will not work with a different encoding. A table of the standardized first 128 ASCII characters can, e.g. be found on http://en.wikipedia.org/wiki/ASCII

5.8 Is LUKS secure with a low-entropy (bad) passphrase?  
 
Note: You should only use the 94 printable characters from 7 bit ASCII code to prevent your passphrase from failing when the character encoding changes, e.g. because of a system upgrade, see also the note at the very start of this FAQ under "WARNINGS".  
 
This needs a bit of theory. The quality of your passphrase is directly related to its entropy (information theoretic, not thermodynamic). The entropy says how many bits of "uncertainty" or "randomness" are in you passphrase. In other words, that is how difficult guessing the passphrase is.  
 
Example: A random English sentence has about 1 bit of entropy per character. A random lowercase (or uppercase) character has about 4.7 bit of entropy.  
 
Now, if n is the number of bits of entropy in your passphrase and t is the time it takes to process a passphrase in order to open the LUKS container, then an attacker has to spend at maximum

time for a successful attack and on average half that. There is no way getting around that relationship. However, there is one thing that does help, namely increasing t, the time it takes to use a passphrase, see next FAQ item.  
 
Still, if you want good security, a high-entropy passphrase is the only option. For example, a low-entropy passphrase can never be considered secure against a TLA-level (Three Letter Agency level, i.e. government-level) attacker, no matter what tricks are used in the key-derivation function. Use at least 64 bits for secret stuff. That is 64 characters of English text (but only if randomly chosen) or a combination of 12 truly random letters and digits.  
 
For passphrase generation, do not use lines from very well-known texts (religious texts, Harry potter, etc.) as they are to easy to guess. For example, the total Harry Potter has about 1'500'000 words (my estimation). Trying every 64 character sequence starting and ending at a word boundary would take only something like 20 days on a single CPU and is entirely feasible. To put that into perspective, using a number of Amazon EC2 High-CPU Extra Large instances (each gives about 8 real cores), this test costs currently about 50USD/EUR, but can be made to run arbitrarily fast.  
 
On the other hand, choosing 1.5 lines from, say, the Wheel of Time is in itself not more secure, but the book selection adds quite a bit of entropy. (Now that I have mentioned it here, don't use tWoT either!) If you add 2 or 3 typos or switch some words around, then this is good passphrase material.