Re: sha256 in "AF hash" despite using sha512 during luksFormat

I understand.
Thank you for all the help!

On Thu, Sep 15, 2022 at 5:17 PM Milan Broz <[email protected]> wrote:
>
> On 10/09/2022 14:53, [email protected] wrote:
> >
> > Do you mean that the choice of 'sha512' for the flag '--hash' is
> > reducing the security strength?
> >  From what I could understand, it shouldn't reduce the security strength.
>
> No, I said it will not increase security (while it can increase processing
> time and keyslot storage space).
>
> > I executed "cryptsetup --help" and found that the following default
> > values are defined:
> >
> > "
> > Default compiled-in key and passphrase parameters:
> ...
>
> > As far as I understand, for LUKS2 the default PBKDF algorithm is
> > 'argon2id' and default hash is 'sha256'.
> > So, I only changed the default hash to 'sha512' by using the flag
> > '--hash', though I didn't change the PBKDF algorithm, so it should
> > stay the default value, i.e. 'argon2id'.
>
> Yes, it is visible in the luksDump output.
> SHA hash was used only for AF for that keyslot.
>
> > Also, I didn't find any mention of the 'Blake64b' hash.
>
> Sorry, my mistake, I meant Blake2b; it uses 64bit words.
>
> See Argon2 RFC:
> https://www.rfc-editor.org/rfc/rfc9106.html
>
>
> Milan



-- 

Best regards,
David.