Re: How to get PBKDF settings of an existing key slot via libcryptsetup ?
Ingo Franzki <[email protected]>
| Newsgroups | gmane.linux.kernel.device-mapper.dm-crypt |
|---|---|
| Message-ID | <[email protected]> |
On 04.02.2019 14:22, Milan Broz wrote: > Hi Ingo, Hi Milan, > > On 31/01/2019 11:14, Ingo Franzki wrote: >> Hi, >> >> is there a way to get the PBKDF settings (struct crypt_pbkdf_type) of an existing key slot in a LUKS2 volume via the libcryptsetup API? > > Not yet, but see below. > >> >> This question is related to the default PBKDF algorithm Argon2i for LUKS2 and the out-of-memory errors that you might get when you unlock multiple LUKS2 volumes during system startup via /etc/crypttab. >> >> One of my application uses crypt_keyslot_add_by_key() to add a new unbound key slot. Unfortunately this new key slot gets the default PBKDF settings, thus it gets Argon2i. I guess if I would use crypt_set_pbkdf_type() before to set PBKDF2, then the new key slot would get PBKDF2 instead of Argon2i. However, I don't want to hard code PBKDF2 here, but I would like to use the PBKDF settings of the key slot that was unlocked before. So I would need a way to get the PBKDF settings of a key slot and then use crypt_set_pbkdf_type() with those settings before calling crypt_keyslot_add_by_key(). That way the new key slot would get the same PBKDF settings as the current one. >> >> Using crypt_get_pbkdf_type() seems to return the default PBKDF algorithm, thus Argon2i for LUKS2. > > Yes, you describe exactly how I intended to use it. (I guess your use key is s390 crypto, so PBKDF2 ok, because it is wrapped key for crypto accelerator, > without the hw attacker cannot run offline attacks here.) > > But since we can now get per-keyslot encryption in LUKS2 through API, there should be also way how to get specific keyslot PBKDF setting (and not only the default). > > It should be relatively simple, so I tried to add such a call - it something like this what you need? > https://gitlab.com/cryptsetup/cryptsetup/commit/8c3be56418248ef5b96265f901122effa88e446b > Yes, that's exactly what I need ! Thanks a lot ! > Thanks, > Milan > > -- Ingo Franzki eMail: [email protected] Tel: ++49 (0)7031-16-4648 Fax: ++49 (0)7031-16-3456 Linux on IBM Z Development, Schoenaicher Str. 220, 71032 Boeblingen, Germany IBM Deutschland Research & Development GmbH / Vorsitzender des Aufsichtsrats: Matthias Hartmann Geschäftsführung: Dirk Wittkopp Sitz der Gesellschaft: Böblingen / Registergericht: Amtsgericht Stuttgart, HRB 243294 IBM DATA Privacy Statement: https://www.ibm.com/privacy/us/en/ _______________________________________________ dm-crypt mailing list [email protected] https://www.saout.de/mailman/listinfo/dm-crypt