Re: [dm-crypt] zuluCrypt v3.0 released.

[Quentin Lefebvre <alto.spam@laposte.net>]

On 06/10/2011 03:27, .. ink .. wrote :
> On Wed, Oct 5, 2011 at 2:18 PM, .. ink .. <mhogomchungu@gmail.com> wrote:
>
>>
>>>>
>>>> It can now (from the GUI)
>>>> 1. Create key files( 512 bytes in size composed of only the 94
printable
>>>> characters).
>>>
>>> 512 bits rather than bytes ?
>>>
>>>
>> i meant bytes, for 512 different characters. I just looked at the
>> documentations and now i cant see why i went with this number since
>> cryptsetup defaults to 256bits(32 bytes).
>>
>> Will change in the next version/update to create 32 bytes key files.
>>
>>
>> just saw where i got the "512 bytes" from., running "cryptsetup --help"
> gives a bunch of output and there is this output at the end.
>
> Default compiled-in keyfile parameters:
>         Maximum keyfile size: 8192kB, Maximum interactive passphrase
length
> 512 (characters)
>
> Default compiled-in device cipher parameters:
>         loop-AES: aes, Key 256 bits
>         plain: aes-cbc-essiv:sha256, Key: 256 bits, Password hashing:
> ripemd160
>         LUKS1: aes-cbc-essiv:sha256, Key: 256 bits, LUKS header hashing:
> sha1, RNG: /dev/urandom
>
> Thats where i got the key file length from. Since my program
interfaces with
> cryptsetup interactively, i though creating a key file with the
maximum size
> allowed will be more secured.
>
> Whats the optimum key file size with the above output?
> Whats the optimum key file size in general?
> The above output seem to suggest 32 bytes files but whats the harm in
using
> 512 bytes?(the maximum allowed)

As far as I now,, it depends on the command line invocation. If you give
no parameter, I think you should use AES (not sure if the key is 128 or
256 bits). But you can change the cipher and key size with appropriate
parameters, as well as the hash algorithm, ... provided your kernel has
the adequate modules loaded. AES key size is either 128 or 256 bits, no
more.
But for example, if you use AES in XTS mode (with something like :
  --cipher=aes-xts-plain )
then you may use 512 bits keys. I'm not aware of longer keys, but not an
expert of cryptsetup though.

Best,
Quentin