Re: sha256 in "AF hash" despite using sha512 during luksFormat

On 10/09/2022 09:26, [email protected] wrote:
> Hi Milan,
> 
> I appreciate your reply.
> 
> Note that I don't have a very good knowledge in crypto.

Then it is always better use defaults :-)

> 
> I prefer sha512 over sha256 only because I've read that it is slightly
> more difficult for GPUs to brute force, because they normally have
> 32bit operations.
> Links to two sources (same author, "Thomas Pornin"):
> https://security.stackexchange.com/questions/86082/hashing-algorithm-for-cryptsetup
> https://security.stackexchange.com/questions/40208/recommended-options-for-luks-cryptsetup

Both are obsoleted for LUKS2 as we switched to Argon2 from PBKDF2 for keyslot
password key derivation. This is what is important here.
(Argon2 is memory hard algorithm and uses internally Blake64b hash.)

For the remaining use of hash (digest, AF, checskum etc) there is no reason
to use anything else than sha256. Of course, you you can, but it will not improve
security of your device.
  
> I don't mind the relatively minor performance impact for read/write operations.

These are not used for data, only for key derivation and has no impact for any
IO operation.  (Please read cryptsetup FAQ document, I think many things are explained there.)

m.