Re: sha256 in "AF hash" despite using sha512 during luksFormat

And just reading your log...

# cryptsetup 2.4.3 processing "cryptsetup --type=luks2 --verbose --debug --hash sha512 --key-size 512 --header /tmp/header.img --key-file - --iter-time=50 luksFormat /dev/sdb1"

If you want to improve security DO NOT decrease keyslot iteration time!

You set 50ms (--iter-time=50) that will cause all KDF parameters to use absolute *minimum*.
(Default is 2000 = 2 seconds!)

The whole discussion about changing hash is pointless then...

m.

On 10/09/2022 00:50, [email protected] wrote:
> Dear cryptsetup/LUKS Team,
> 
> I was using sha512 in the luksFormat command.
> Later I used luksAddKey while thinking that it should be using the
> sha512 hash that I defined in luksFormat.
> But, when I did luksDump, then I noticed that the field "AF hash" for
> the second key (which was added via luksAddKey ; its keyslot is #1)
> contains the value "sha256".
> I expected it to contain sha512.
> Notice that keyslot#0 has "sha512" in its corresponding "AF hash" field.
> 
> Attached script which reproduces that issue, filename
> "reproduce_commands_without_hash.sh".
> Attached output of the script, filename
> "reproduce_commands_without_hash.log.txt".
> 
> Did I miss something?
> 
> Best regards,
> David.