Re: sha256 in "AF hash" despite using sha512 during luksFormat

> Then it is always better use defaults :-)

Haha, indeed I somewhat agree, though I do want to learn a little bit
and be more aware of my configurations.


> Both are obsoleted for LUKS2 as we switched to Argon2 from PBKDF2 for keyslot
> password key derivation. This is what is important here.
> (Argon2 is memory hard algorithm and uses internally Blake64b hash.)

Do you mean that the choice of 'sha512' for the flag '--hash' is
reducing the security strength?
From what I could understand, it shouldn't reduce the security strength.

I executed "cryptsetup --help" and found that the following default
values are defined:

"
Default compiled-in key and passphrase parameters:
    Maximum keyfile size: 8192kB, Maximum interactive passphrase
length 512 (characters)
Default PBKDF for LUKS1: pbkdf2, iteration time: 2000 (ms)
Default PBKDF for LUKS2: argon2id
    Iteration time: 2000, Memory required: 1048576kB, Parallel threads: 4

Default compiled-in device cipher parameters:
    loop-AES: aes, Key 256 bits
    plain: aes-cbc-essiv:sha256, Key: 256 bits, Password hashing: ripemd160
    LUKS: aes-xts-plain64, Key: 256 bits, LUKS header hashing: sha256,
RNG: /dev/urandom
    LUKS: Default keysize with XTS mode (two internal keys) will be doubled.
"


As far as I understand, for LUKS2 the default PBKDF algorithm is
'argon2id' and default hash is 'sha256'.
So, I only changed the default hash to 'sha512' by using the flag
'--hash', though I didn't change the PBKDF algorithm, so it should
stay the default value, i.e. 'argon2id'.
And indeed we can see these values in the log file
("reproduce_commands_without_hash.log.txt") which is attached to the
previous email that I sent - boths keyslots (keyslot #0 and keyslot
#1) have the following property:
"PBKDF:      argon2id"

Thus, the 'PBKDF' algorithm is still the best for LUKS2 in the
cryptsetup flags configuration that I chose, I think.

Also, I didn't find any mention of the 'Blake64b' hash.

> These are not used for data, only for key derivation and has no impact for any
> IO operation.  (Please read cryptsetup FAQ document, I think many things are  explained there.)

I understand.
I've read the cryptsetup FAQ but will try giving it another read,
perhaps things could be clearer.


On Sat, Sep 10, 2022 at 1:28 PM Milan Broz <[email protected]> wrote:
>
> On 10/09/2022 09:26, [email protected] wrote:
> > Hi Milan,
> >
> > I appreciate your reply.
> >
> > Note that I don't have a very good knowledge in crypto.
>
> Then it is always better use defaults :-)
>
> >
> > I prefer sha512 over sha256 only because I've read that it is slightly
> > more difficult for GPUs to brute force, because they normally have
> > 32bit operations.
> > Links to two sources (same author, "Thomas Pornin"):
> > https://security.stackexchange.com/questions/86082/hashing-algorithm-for-cryptsetup
> > https://security.stackexchange.com/questions/40208/recommended-options-for-luks-cryptsetup
>
> Both are obsoleted for LUKS2 as we switched to Argon2 from PBKDF2 for keyslot
> password key derivation. This is what is important here.
> (Argon2 is memory hard algorithm and uses internally Blake64b hash.)
>
> For the remaining use of hash (digest, AF, checskum etc) there is no reason
> to use anything else than sha256. Of course, you you can, but it will not improve
> security of your device.
>
> > I don't mind the relatively minor performance impact for read/write operations.
>
> These are not used for data, only for key derivation and has no impact for any
> IO operation.  (Please read cryptsetup FAQ document, I think many things are explained there.)
>
> m.



-- 

Best regards,
David.