Re: reencrypt: how to specify old and new key-files?

Philippe Cerfon <[email protected]>
Newsgroups dev.linux.lists.cryptsetup
Message-ID <CAN+za=OQGkWPiiket8_7kG3UgboDqTJ+-cdaBVoC4xdgSUQzww@mail.gmail.com>
One more thing which is a bit confusing to me:
- There's luksChangeKey (and the somewhat overlapping luksConvertKey)
which changes a keyslot key/passphrase and/or its KDF algo/params.
- cryptsetup reencrypt, also allows to change the KDF algo/params (but
not the keyslot key/passphrase), which makes that part of identical to
luksConvertKey.


With all of them (luksChangeKey, luksConvertKey, reencrypt), what does
cryptsetup do when I don't specify the --pbkdf / --iter-time /
--pbkdf-memory / --pbkdf-parallel / --pbkdf-force-iterations options?
- For reencrypt the manpage says that for --cipher, it would use the
existing algo when really re-encrypting and the default when freshly
encrypting.
- But what about these options, when I don't specify ANY of the KDF
algo/param options? Do they use the same than what's been there
before? Or the default?
- What, if one specifies ONLY SOME of them? E.g. it was previously
PBKDF2, and I do only --pbkdf argon2id  OR  only that and
--pbkdf-parallel 4 - will the others get defaults?

Tanks,
Philippe
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.