Re: reencrypt: how to specify old and new key-files?
Philippe Cerfon <[email protected]>
| Newsgroups | dev.linux.lists.cryptsetup |
|---|---|
| Message-ID | <CAN+za=OQGkWPiiket8_7kG3UgboDqTJ+-cdaBVoC4xdgSUQzww@mail.gmail.com> |
One more thing which is a bit confusing to me: - There's luksChangeKey (and the somewhat overlapping luksConvertKey) which changes a keyslot key/passphrase and/or its KDF algo/params. - cryptsetup reencrypt, also allows to change the KDF algo/params (but not the keyslot key/passphrase), which makes that part of identical to luksConvertKey. With all of them (luksChangeKey, luksConvertKey, reencrypt), what does cryptsetup do when I don't specify the --pbkdf / --iter-time / --pbkdf-memory / --pbkdf-parallel / --pbkdf-force-iterations options? - For reencrypt the manpage says that for --cipher, it would use the existing algo when really re-encrypting and the default when freshly encrypting. - But what about these options, when I don't specify ANY of the KDF algo/param options? Do they use the same than what's been there before? Or the default? - What, if one specifies ONLY SOME of them? E.g. it was previously PBKDF2, and I do only --pbkdf argon2id OR only that and --pbkdf-parallel 4 - will the others get defaults? Tanks, Philippe