Re: [dm-crypt] Debian installer formatting LUKS2 devices by default?

[Milan Broz <gmazyland@gmail.com>]

Hi,

On 25/01/2019 14:54, Guilhem Moulin wrote:
> On Fri, 23 Nov 2018 at 10:21:40 +0100, Milan Broz wrote:
>> I had to postpone a plan to release 2.1 with LUKS2 as default format
>> (to January/February 2019), and we will release very soon 2.0.6 with
>> some fixes of LUKS2 format validation that need to be in place before
>> we switch the default.
> 
> With the full Freeze approaching we (Debian package maintainers) are
> often asked about LUKS2 status; so I wonder if the plan is still to
> release 2.1 before the end of February? :-)

I planned to send some heads-up mail this week. It is a busy week here :)
Sorry.

In short, this is the plan and major changes (I'll write more details later)

- 2.1 should be released 5.2.2019

(Definitely not later, some slight change that it happens earlier.
I am traveling days before it, and we need some time for translators.
But git will be almost ready for 2.1 next week.)

- no soname bump, just compatible version increase (only added symbols)

- LUKS2 becomes the default format

- There are new options to fine-tune LUKS2 header size
(metadata and keyslots area, possible different per-keyslot encryption).

- we switch to OpenSSL as a default cryptographic backend
  (you can still use gcrypt with configure-time option)

- Some small hardening in cipher parameters and PBKDF

- new refresh command to allow parameter changes for the active device
  (for example it allows toggle TRIM support for root device)

- Authenticated encryption stays as an experimental feature
only with a few supported algorithms (with plans to work on it in 2.2).

If you rely on some stable release earlier, let me know, please.

Thanks,
Milan