Re: Bypass kdf step with LUKS2

On 6/23/23 16:01, Rishi Dhupar wrote:
> Hi,
> 
> I have an unusual request. Is there any way to skip the PBKDF2 step
> when a device is being formatted with LUKS2 or an additional slot is
> being added?

No, you cannot skip PBKDF, this is by design.

But you can set KDF to PBKDF2 with minimal iteration count (1000),
this will be very fast.

Something like: --pbkdf pbkdf2 --pbkdf-force-iterations 1000
(this should also skip KDF benchmarking)

Milan

> 
> Here's why I'm asking: I am using a high entropy 256-bit key as my
> keyfile and the KDF step is unnecessary and does not improve my
> security profile. If I am managing thousands of devices and want to
> rotate the passphrases on them, this KDF step is becoming the major
> bottleneck in performance.
> 
> Thanks
>