Re: [dm-crypt] How to get PBKDF settings of an existing key slot via libcryptsetup ?

[Milan Broz <gmazyland@gmail.com>]

Hi Ingo,

On 31/01/2019 11:14, Ingo Franzki wrote:
> Hi,
> 
> is there a way to get the PBKDF settings (struct crypt_pbkdf_type) of an existing key slot in a LUKS2 volume via the libcryptsetup API? 

Not yet, but see below.

> 
> This question is related to the default PBKDF algorithm Argon2i for LUKS2 and the out-of-memory errors that you might get when you unlock multiple LUKS2 volumes during system startup via /etc/crypttab.
> 
> One of my application uses crypt_keyslot_add_by_key() to add a new unbound key slot. Unfortunately this new key slot gets the default PBKDF settings, thus it gets Argon2i. I guess if I would use crypt_set_pbkdf_type() before to set PBKDF2, then the new key slot would get PBKDF2 instead of Argon2i. However, I don't want to hard code PBKDF2 here, but I would like to use the PBKDF settings of the key slot that was unlocked before. So I would need a way to get the PBKDF settings of a key slot and then use crypt_set_pbkdf_type() with those settings before calling crypt_keyslot_add_by_key(). That way the new key slot would get the same PBKDF settings as the current one.
> 
> Using crypt_get_pbkdf_type() seems to return the default PBKDF algorithm, thus Argon2i for LUKS2. 

Yes, you describe exactly how I intended to use it. (I guess your use key is s390 crypto, so PBKDF2 ok, because it is wrapped key for crypto accelerator,
without the hw attacker cannot run offline attacks here.)

But since we can now get per-keyslot encryption in LUKS2 through API, there should be also way how to get specific keyslot PBKDF setting (and not only the default).

It should be relatively simple, so I tried to add such a call - it something like this what you need?
  https://gitlab.com/cryptsetup/cryptsetup/commit/8c3be56418248ef5b96265f901122effa88e446b

Thanks,
Milan