From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <wagner@tansi.org>
Received: from v6.tansi.org (ns.km31936-01.keymachine.de [87.118.116.4])
 by mail.server123.net (Postfix) with ESMTP
 for <dm-crypt@saout.de>; Tue,  9 Sep 2014 00:33:10 +0200 (CEST)
Received: from gatewagner.dyndns.org (77-57-44-24.dclient.hispeed.ch
 [77.57.44.24]) by v6.tansi.org (Postfix) with ESMTPA id 8E4D120DC1E9
 for <dm-crypt@saout.de>; Tue,  9 Sep 2014 00:33:09 +0200 (CEST)
Date: Tue, 9 Sep 2014 00:33:09 +0200
From: Arno Wagner <arno@wagner.name>
Message-ID: <20140908223309.GA19869@tansi.org>
References: <CAFnMBaTUUYUm3zaxyT-t9+GjTF9SMxuvr1ep+UfV35eCKQB1Lg@mail.gmail.com>
 <540C8EE9.7070006@gmail.com>
 <CAFnMBaT62qeLYz4dwdHd1L7UcCxseU4hFO8MamkxF-A10bF6BQ@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <CAFnMBaT62qeLYz4dwdHd1L7UcCxseU4hFO8MamkxF-A10bF6BQ@mail.gmail.com>
Subject: Re: [dm-crypt] list of supported encryption options for LUKS
List-Id: <dm-crypt.saout.de>
List-Unsubscribe: <http://www.saout.de/mailman/options/dm-crypt>,
 <mailto:dm-crypt-request@saout.de?subject=unsubscribe>
List-Archive: <http://www.saout.de/pipermail/dm-crypt/>
List-Post: <mailto:dm-crypt@saout.de>
List-Help: <mailto:dm-crypt-request@saout.de?subject=help>
List-Subscribe: <http://www.saout.de/mailman/listinfo/dm-crypt>,
 <mailto:dm-crypt-request@saout.de?subject=subscribe>
To: dm-crypt@saout.de

On Mon, Sep 08, 2014 at 21:42:06 CEST, .. ink .. wrote:
> On Sun, Sep 7, 2014 at 12:59 PM, Milan Broz <gmazyland@gmail.com> wrote:
> 
> 
> 
> > But I still think that there should be only few strong predefined
> > combinations.
> >
> >
> The list of option i am going to support for LUKS volumes is listed below
> as taken from cryptsetup benchmark list.
> 
> First condition is for plain volumes,second condition for luks and the last
> one is for truecrypt.
> 
> https://github.com/mhogomchungu/zuluCrypt/blob/c99841c21a6edeea955106134fd54d5935f8e237/zuluCrypt-gui/createvolume.cpp#L238

I would add a warning about gcrypt (see FAQ 8.3) for all
variants with whirlpool. Some people may still use this with
the broken gcrypt implementation.

Apart from that, the list looks fine.

Side-question:
Are the multi-cipher variants like "twofish:aes.xts-plain64.256.ripemd160"
something you do yourself? How do you do them? Additional 
LUKS layers with the same passphrase set-up?

Arno
-- 
Arno Wagner,     Dr. sc. techn., Dipl. Inform.,    Email: arno@wagner.name
GnuPG: ID: CB5D9718  FP: 12D6 C03B 1B30 33BB 13CF  B774 E35C 5FA1 CB5D 9718
----
A good decision is based on knowledge and not on numbers. -- Plato

If it's in the news, don't worry about it.  The very definition of 
"news" is "something that hardly ever happens." -- Bruce Schneier