Re: F45 Change Proposal: Disable in Kernel Crypto Userspace API (Phase 1) (self-contained)

> On 24 Jul 2026, at 11:15, Peter Robinson <[email protected]> wrote:
> 
>> - there's no xts mode implemented for camellia, serpent and twofish
>> ciphers in openssl (I mention only the most used AES alternatives). So
>> the cryptsetup (in Fedora) will loose userspace access to those ciphers
>> without CAP_SYS_ADMIN. Affects LUKS2.
> 
> Can you provide details of where they are used in Fedora? I believe
> these would only be used if a user when out of their way to use those,
> generally via a manual install process.


I'm one of the people that has done manual setup with a cypher that is affected.

On a Rpi4 I have a luks2 vault that I setup with advice from the *internet* that advised to
use these setting as the Rpi would strugle with the defaults.

	Cipher:     aes-xts-plain64
	PBKDF:      argon2id

Clearly I will have to migrate to a supported cypher before upgrading to f45.

Barry

-- 
_______________________________________________
devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/[email protected]
Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new