Re: Bypass kdf step with LUKS2

Thanks. Exactly what I was looking for, this had a massive improvement in time.

# time cat luks_passphrase | cryptsetup luksFormat /dev/rbd0 -d- --pbkdf pbkdf2
WARNING: Device /dev/rbd0 already contains a 'crypto_LUKS' superblock signature.

real    0m4.488s
user    0m4.177s
sys    0m0.060s
# time cat luks_passphrase | cryptsetup luksAddKey /dev/rbd0 -d-
luks_passphrase --pbkdf pbkdf2

real    0m7.075s
user    0m7.023s
sys    0m0.013s

# time cat luks_passphrase | cryptsetup luksFormat /dev/rbd0 -d-
--pbkdf pbkdf2 --pbkdf-force-iterations 1000
WARNING: Device /dev/rbd0 already contains a 'crypto_LUKS' superblock signature.

real    0m0.312s
user    0m0.008s
sys    0m0.054s
# time cat luks_passphrase | cryptsetup luksAddKey /dev/rbd0 -d-
luks_passphrase --pbkdf pbkdf2 --pbkdf-force-iterations 1000

real    0m0.044s
user    0m0.017s
sys    0m0.006s

On Fri, Jun 23, 2023 at 10:17 AM Milan Broz <[email protected]> wrote:
>
> On 6/23/23 16:01, Rishi Dhupar wrote:
> > Hi,
> >
> > I have an unusual request. Is there any way to skip the PBKDF2 step
> > when a device is being formatted with LUKS2 or an additional slot is
> > being added?
>
> No, you cannot skip PBKDF, this is by design.
>
> But you can set KDF to PBKDF2 with minimal iteration count (1000),
> this will be very fast.
>
> Something like: --pbkdf pbkdf2 --pbkdf-force-iterations 1000
> (this should also skip KDF benchmarking)
>
> Milan
>
> >
> > Here's why I'm asking: I am using a high entropy 256-bit key as my
> > keyfile and the KDF step is unnecessary and does not improve my
> > security profile. If I am managing thousands of devices and want to
> > rotate the passphrases on them, this KDF step is becoming the major
> > bottleneck in performance.
> >
> > Thanks
> >