Re: sha256 in "AF hash" despite using sha512 during luksFormat
Milan Broz <[email protected]>
| Newsgroups | dev.linux.lists.cryptsetup |
|---|---|
| Message-ID | <[email protected]> |
On 10/09/2022 14:53, [email protected] wrote: > > Do you mean that the choice of 'sha512' for the flag '--hash' is > reducing the security strength? > From what I could understand, it shouldn't reduce the security strength. No, I said it will not increase security (while it can increase processing time and keyslot storage space). > I executed "cryptsetup --help" and found that the following default > values are defined: > > " > Default compiled-in key and passphrase parameters: ... > As far as I understand, for LUKS2 the default PBKDF algorithm is > 'argon2id' and default hash is 'sha256'. > So, I only changed the default hash to 'sha512' by using the flag > '--hash', though I didn't change the PBKDF algorithm, so it should > stay the default value, i.e. 'argon2id'. Yes, it is visible in the luksDump output. SHA hash was used only for AF for that keyslot. > Also, I didn't find any mention of the 'Blake64b' hash. Sorry, my mistake, I meant Blake2b; it uses 64bit words. See Argon2 RFC: https://www.rfc-editor.org/rfc/rfc9106.html Milan