Re: cryptsetup LUKS: Too low iteration count: only 14
Arno Wagner <[email protected]>
| Newsgroups | dev.linux.lists.cryptsetup |
|---|---|
| Message-ID | <[email protected]> |
On Sat, Aug 13, 2022 at 18:11:48 CEST, Milan Broz wrote: > On 13/08/2022 17:50, [email protected] wrote: > > Hi all, > > > > I was playing around with LUKS extension in cryptsetup and noticed > > that the iteration count was 14 in my case. > > The iteration time that I chose (arbitrarily) is 4123ms which is above > > 4 seconds! > > So I was astonished to see an iteration count which is very low. > > As far as I know, using a modern computer, the iteration count should > > be above 100k. > > Please do not confuse iteration for PBKDF2 (default in LUKS1) and > memory-hard Argon2 KDF. > > These are completely different algorithms, you cannot compare iteration > costs here. > > If you set 100k iteration with 1G memory cost for Argon2, you will get > unlocking time that is perhaps in years... :-) Argon2 operates on a completely different iteration scale than PBKDF2 by a factor of 100'000 or so. A look into the documentation may help. If I remember correctly the recommended minimal iteration count for Argon2 is 4. Regards, Arno -- Arno Wagner, Dr. sc. techn., Dipl. Inform., Email: [email protected] GnuPG: ID: CB5D9718 FP: 12D6 C03B 1B30 33BB 13CF B774 E35C 5FA1 CB5D 9718 ---- A good decision is based on knowledge and not on numbers. -- Plato If it's in the news, don't worry about it. The very definition of "news" is "something that hardly ever happens." -- Bruce Schneier