Re: [dm-crypt] different default key sizes for CREATE and LUKSFORMAT

[Milan Broz <mbroz@redhat.com>]

On 11/19/2009 02:00 PM, Heinz Diehl wrote:
> On 19.11.2009, Arno Wagner wrote: 
> 
>> Anybody having real slowdown because they run this 
>> on a 25 Mhz 386SX CPU can still reduce the count via commandline.
> 
> I'm afraid there is no commandline option to change that. "--iter-time" is 
> related to the iterations of the passphrase, not the MK.

yes but I do not want add another iteration option, too confusing to users.

What about derive the MK digest iteration count from calculated keyslot
iteration time (I suggest 1/5 of calculated time) - so for default 1 second
it is cca 200ms - not accurate, because benchmark uses different message on input)
but with minimum 1000 iterations?

(on my quite slow testing VM it is cca 20000 iterations)

This should be enough.
This will add maximum 1.6 second processing time if all 8 slots is used,
so it is acceptable but also provides needed slow-down for brute force.

Milan
--
mbroz@redhat.com