Re: cryptsetup LUKS: Too low iteration count: only 14

[Arno Wagner <arno@wagner.name>]

On Sat, Aug 13, 2022 at 18:11:48 CEST, Milan Broz wrote:
> On 13/08/2022 17:50, doffloster@gmail.com wrote:
> > Hi all,
> > 
> > I was playing around with LUKS extension in cryptsetup and noticed
> > that the iteration count was 14 in my case.
> > The iteration time that I chose (arbitrarily) is 4123ms which is above
> > 4 seconds!
> > So I was astonished to see an iteration count which is very low.
> > As far as I know, using a modern computer, the iteration count should
> > be above 100k.
> 
> Please do not confuse iteration for PBKDF2 (default in LUKS1) and
> memory-hard Argon2 KDF.
> 
> These are completely different algorithms, you cannot compare iteration
> costs here.
> 
> If you set 100k iteration with 1G memory cost for Argon2, you will get
> unlocking time that is perhaps in years... :-)

Argon2 operates on a completely different iteration scale than
PBKDF2 by a factor of 100'000 or so. 

A look into the documentation may help. If I remember correctly
the recommended minimal iteration count for Argon2 is 4.

Regards,
Arno

-- 
Arno Wagner,     Dr. sc. techn., Dipl. Inform.,    Email: arno@wagner.name
GnuPG: ID: CB5D9718  FP: 12D6 C03B 1B30 33BB 13CF  B774 E35C 5FA1 CB5D 9718
----
A good decision is based on knowledge and not on numbers. -- Plato

If it's in the news, don't worry about it.  The very definition of 
"news" is "something that hardly ever happens." -- Bruce Schneier