Re: sha256 in "AF hash" despite using sha512 during luksFormat

Thank you for inspecting my log.
I used the low iteration time just for the reproduction example - in
the script there is the following line:

> ITER_TIME=50 # Just to make it fast

So, I am aware of the iteration time issue.
In reality I use an iteration time which is higher than the default
(default iteration time is 2000ms).

On Sat, Sep 10, 2022 at 1:34 PM Milan Broz <[email protected]> wrote:
>
> And just reading your log...
>
> # cryptsetup 2.4.3 processing "cryptsetup --type=luks2 --verbose --debug --hash sha512 --key-size 512 --header /tmp/header.img --key-file - --iter-time=50 luksFormat /dev/sdb1"
>
> If you want to improve security DO NOT decrease keyslot iteration time!
>
> You set 50ms (--iter-time=50) that will cause all KDF parameters to use absolute *minimum*.
> (Default is 2000 = 2 seconds!)
>
> The whole discussion about changing hash is pointless then...
>
> m.
>
> On 10/09/2022 00:50, [email protected] wrote:
> > Dear cryptsetup/LUKS Team,
> >
> > I was using sha512 in the luksFormat command.
> > Later I used luksAddKey while thinking that it should be using the
> > sha512 hash that I defined in luksFormat.
> > But, when I did luksDump, then I noticed that the field "AF hash" for
> > the second key (which was added via luksAddKey ; its keyslot is #1)
> > contains the value "sha256".
> > I expected it to contain sha512.
> > Notice that keyslot#0 has "sha512" in its corresponding "AF hash" field.
> >
> > Attached script which reproduces that issue, filename
> > "reproduce_commands_without_hash.sh".
> > Attached output of the script, filename
> > "reproduce_commands_without_hash.log.txt".
> >
> > Did I miss something?
> >
> > Best regards,
> > David.



-- 

Best regards,
David.