From: Milan Broz <gmazyland@gmail.com>
To: dm-crypt@saout.de
Subject: Re: [dm-crypt] Switch to XTS mode for LUKS in cryptsetup in 1.6.0 (Was Re: [ANNOUNCE] cryptsetup 1.6.0-rc1)
Date: Sat, 05 Jan 2013 19:25:52 +0100 [thread overview]
Message-ID: <50E87030.3070004@gmail.com> (raw)
In-Reply-To: <20130105172034.GA2859@tansi.org>
On 01/05/2013 06:20 PM, Arno Wagner wrote:
> What does RHEL use and recommend? Do they always use
> AES256-XTS or is AES128-XTS offered as an option (not when
> douing this manually via commandline). I think there would
> be some benefit to have the same defauls in distro-independent
> cryptsetup.
- Encrypted disk installation is using AES-XTS with 512bit key.
(installer overwrites default. But I know there was no
real discussion about AES18/256 before this was changed.)
Installed (anaconda) doesn't allow default cipher/key size change
but allows to "reuse" existing LUKS device.
- compiled-in cryptsetup default is the same as upstream (CBC with ESSIV)
(RHEL7 will use XTS as default, I would like to see the same
default as upstream.)
(This was mainly for compatibility reasons but now even RHEL5 can
map XTS LUKS discs.)
- RHEL in FIPS mode (dmcrypt/LUKS module is still not validated though)
allows CBC (only with ESSIV) and XTS with AES128/192/256
Well, I can get more info from independent people here internally.
My current opinion is to use aes-xts-plain64 with 256bit key
(IOW use AES128) as independent default for LUKS.
Milan
next prev parent reply other threads:[~2013-01-05 18:25 UTC|newest]
Thread overview: 40+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-12-29 21:40 [dm-crypt] [ANNOUNCE] cryptsetup 1.6.0-rc1 Milan Broz
2012-12-29 22:24 ` Matthias Schniedermeyer
2012-12-29 22:42 ` Milan Broz
2012-12-29 23:21 ` Matthias Schniedermeyer
2012-12-29 23:15 ` Matthias Schniedermeyer
2012-12-29 23:31 ` Milan Broz
2013-01-02 12:50 ` Matthias Schniedermeyer
2013-01-02 20:55 ` Milan Broz
2012-12-30 8:38 ` Arno Wagner
2012-12-30 8:56 ` Sven Eschenberg
2012-12-30 10:20 ` Arno Wagner
2012-12-30 11:40 ` Milan Broz
2013-01-06 12:16 ` Yves-Alexis Perez
2013-01-06 16:24 ` Milan Broz
2013-01-07 6:23 ` Yves-Alexis Perez
2013-01-07 8:53 ` Milan Broz
2013-01-07 11:21 ` Sven Eschenberg
2013-01-07 18:12 ` Milan Broz
2013-01-07 19:20 ` Sven Eschenberg
2013-01-21 21:01 ` Yves-Alexis Perez
2012-12-30 11:47 ` Milan Broz
2013-01-05 19:47 ` Jonas Meurer
2012-12-30 9:03 ` Milan Broz
2013-01-04 11:50 ` [dm-crypt] Switch to XTS mode for LUKS in cryptsetup in 1.6.0 (Was Re: [ANNOUNCE] cryptsetup 1.6.0-rc1) Milan Broz
2013-01-04 11:53 ` Ralf Ramsauer
2013-01-04 12:18 ` Milan Broz
2013-01-04 16:26 ` Arno Wagner
2013-01-04 20:20 ` Heinz Diehl
2013-01-04 20:56 ` Milan Broz
2013-01-04 22:05 ` Arno Wagner
2013-01-04 22:39 ` Milan Broz
2013-01-05 17:20 ` Arno Wagner
2013-01-05 18:25 ` Milan Broz [this message]
2013-01-05 19:47 ` Arno Wagner
2013-01-04 13:39 ` Christoph Anton Mitterer
2013-01-04 16:17 ` Arno Wagner
2013-01-04 17:36 ` Zdenek Kaspar
2013-01-04 18:55 ` Romain Francoise
2013-01-04 19:14 ` Milan Broz
2013-01-04 21:56 ` Arno Wagner
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=50E87030.3070004@gmail.com \
--to=gmazyland@gmail.com \
--cc=dm-crypt@saout.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox