Re: F45 Change Proposal: Disable in Kernel Crypto Userspace API (Phase 1) (self-contained)

On Fri, 24 Jul 2026 at 12:08, Barry Scott <[email protected]> wrote:
>
>
>
> On 24 Jul 2026, at 11:15, Peter Robinson <[email protected]> wrote:
>
> - there's no xts mode implemented for camellia, serpent and twofish
> ciphers in openssl (I mention only the most used AES alternatives). So
> the cryptsetup (in Fedora) will loose userspace access to those ciphers
> without CAP_SYS_ADMIN. Affects LUKS2.
>
>
> Can you provide details of where they are used in Fedora? I believe
> these would only be used if a user when out of their way to use those,
> generally via a manual install process.
>
>
> I'm one of the people that has done manual setup with a cypher that is affected.
>
> On a Rpi4 I have a luks2 vault that I setup with advice from the *internet* that advised to
> use these setting as the Rpi would strugle with the defaults.

The internet wasn't entirely correct, the rpi3/4 are the only devices
I'm aware of that don't have the complete aarch64 crypto extensions
but there's been a lot of work done upstream to make them decent using
NEON.

> Cipher:     aes-xts-plain64
> PBKDF:      argon2id

Those are the defaults, what did you actually use?

> Clearly I will have to migrate to a supported cypher before upgrading to f45.

Well not for f45 but before long.
-- 
_______________________________________________
devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/[email protected]
Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new