Re: LUKS and quantum computing

[Milan Broz <gmazyland@gmail.com>]

On 11/25/24 11:13 PM, Patrick Callaghan wrote:
> If we use LUKS encryption with SHA-256 configured (i.e. the
> default), is this considered safe against attacks by quantum
> computers?

SHA256 has no problem, specifically if used for PBKDF2
(iterative hashing for key derivation).

Default LUKS2 configuration no longer use SHA256 anyway, only for
antiforensic filter (split key material among more sectors) and
this is not a cryptographically relevant operation.

We use Argon2 with Blake2 hash internally for PBKDF now in LUKS2.

> I ask because NIST suggests SHA512 in general for quantum safe
> algorithms (see "old Q17" in https://csrc.nist.gov/projects/post-
> quantum-cryptography/faqs) and we want to be LUKS quantum safe now
> and for several years to come, even if no practical attacks
> currently exist.
> 
> Note, the cipher we use is "aes-xts-plain64" so we have no question
> about this as AES with 256-bit keys is considered quantum safe.

The 256bit (2x256 bit for XTS) key is default, this is according to
what is suggested in general (even in the context of QC).
Otherwise there should be no problem with symmetric encryption related
to quantum computing.

BTW who is "we" in your pararaph?

Milan