From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-wr1-x443.google.com (mail-wr1-x443.google.com [IPv6:2a00:1450:4864:20::443]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.server123.net (Postfix) with ESMTPS for ; Fri, 25 Jan 2019 15:31:41 +0100 (CET) Received: by mail-wr1-x443.google.com with SMTP id p7so10566173wru.0 for ; Fri, 25 Jan 2019 06:31:40 -0800 (PST) Received: from [10.43.17.38] (nat-pool-brq-t.redhat.com. [213.175.37.10]) by smtp.gmail.com with ESMTPSA id e17sm166500920wri.36.2019.01.25.06.31.39 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 25 Jan 2019 06:31:39 -0800 (PST) References: <20180727081626.GA29834@localhost.localdomain> <20180730204718.GA16752@localhost.localdomain> <20180731060030.GA15852@h-174-65.A328.priv.bahnhof.se> <20180731075342.GA25101@localhost.localdomain> <20190125135442.GA24862@fripost.org> From: Milan Broz Message-ID: <71db2159-bb20-c9a5-19bc-c597b2a33788@gmail.com> Date: Fri, 25 Jan 2019 15:31:38 +0100 MIME-Version: 1.0 In-Reply-To: <20190125135442.GA24862@fripost.org> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit Subject: Re: [dm-crypt] Debian installer formatting LUKS2 devices by default? List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: dm-crypt@saout.de Hi, On 25/01/2019 14:54, Guilhem Moulin wrote: > On Fri, 23 Nov 2018 at 10:21:40 +0100, Milan Broz wrote: >> I had to postpone a plan to release 2.1 with LUKS2 as default format >> (to January/February 2019), and we will release very soon 2.0.6 with >> some fixes of LUKS2 format validation that need to be in place before >> we switch the default. > > With the full Freeze approaching we (Debian package maintainers) are > often asked about LUKS2 status; so I wonder if the plan is still to > release 2.1 before the end of February? :-) I planned to send some heads-up mail this week. It is a busy week here :) Sorry. In short, this is the plan and major changes (I'll write more details later) - 2.1 should be released 5.2.2019 (Definitely not later, some slight change that it happens earlier. I am traveling days before it, and we need some time for translators. But git will be almost ready for 2.1 next week.) - no soname bump, just compatible version increase (only added symbols) - LUKS2 becomes the default format - There are new options to fine-tune LUKS2 header size (metadata and keyslots area, possible different per-keyslot encryption). - we switch to OpenSSL as a default cryptographic backend (you can still use gcrypt with configure-time option) - Some small hardening in cipher parameters and PBKDF - new refresh command to allow parameter changes for the active device (for example it allows toggle TRIM support for root device) - Authenticated encryption stays as an experimental feature only with a few supported algorithms (with plans to work on it in 2.2). If you rely on some stable release earlier, let me know, please. Thanks, Milan