From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.saout.de ([127.0.0.1]) by localhost (mail.saout.de [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kC1ujUSYunP3 for ; Fri, 4 Jan 2013 12:50:08 +0100 (CET) Received: from mail-ea0-f181.google.com (mail-ea0-f181.google.com [209.85.215.181]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by mail.saout.de (Postfix) with ESMTPS for ; Fri, 4 Jan 2013 12:50:08 +0100 (CET) Received: by mail-ea0-f181.google.com with SMTP id k14so6499331eaa.26 for ; Fri, 04 Jan 2013 03:50:07 -0800 (PST) Message-ID: <50E6C1EC.1000307@gmail.com> Date: Fri, 04 Jan 2013 12:50:04 +0100 From: Milan Broz MIME-Version: 1.0 References: <50DF635C.90003@gmail.com> In-Reply-To: <50DF635C.90003@gmail.com> Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Subject: [dm-crypt] Switch to XTS mode for LUKS in cryptsetup in 1.6.0 (Was Re: [ANNOUNCE] cryptsetup 1.6.0-rc1) List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: dm-crypt On 12/29/2012 10:40 PM, Milan Broz wrote: > The testing release candidate cryptsetup 1.6.0-rc1 is available at > > http://code.google.com/p/cryptsetup/ > > Feedback and bug reports are welcomed. > > Cryptsetup 1.6.0 Release Notes (RC1) I am going to do one more important change to final 1.6.0: change LUKS _default_ cipher to aes-xts-plain64 with 512bits key. Most of recent disk encryption systems switched already to XTS mode, also it is preferred by standards (and we are using it for very long time in Fedora/RHEL during installations.) Distro maintainers can always overwrite this during compilation time, and user can use -c aes-cbc-essiv:sha256 -s 256 to old mode always. (Plain mode have to stay with CBC, change would cause compatibility problems.) Any serious objections to not do that now? Milan