From: Philippe Cerfon <philcerf@gmail.com>
To: Ondrej Kozina <okozina@redhat.com>
Cc: cryptsetup@lists.linux.dev
Subject: Re: reencrypt: how to specify old and new key-files?
Date: Fri, 11 Nov 2022 19:11:52 +0100 [thread overview]
Message-ID: <CAN+za=OQGkWPiiket8_7kG3UgboDqTJ+-cdaBVoC4xdgSUQzww@mail.gmail.com> (raw)
In-Reply-To: <480cac2f-f20a-e769-f33f-3d1a57e62b01@redhat.com>
One more thing which is a bit confusing to me:
- There's luksChangeKey (and the somewhat overlapping luksConvertKey)
which changes a keyslot key/passphrase and/or its KDF algo/params.
- cryptsetup reencrypt, also allows to change the KDF algo/params (but
not the keyslot key/passphrase), which makes that part of identical to
luksConvertKey.
With all of them (luksChangeKey, luksConvertKey, reencrypt), what does
cryptsetup do when I don't specify the --pbkdf / --iter-time /
--pbkdf-memory / --pbkdf-parallel / --pbkdf-force-iterations options?
- For reencrypt the manpage says that for --cipher, it would use the
existing algo when really re-encrypting and the default when freshly
encrypting.
- But what about these options, when I don't specify ANY of the KDF
algo/param options? Do they use the same than what's been there
before? Or the default?
- What, if one specifies ONLY SOME of them? E.g. it was previously
PBKDF2, and I do only --pbkdf argon2id OR only that and
--pbkdf-parallel 4 - will the others get defaults?
Tanks,
Philippe
prev parent reply other threads:[~2022-11-11 18:12 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-11-08 22:52 reencrypt: how to specify old and new key-files? Philippe Cerfon
2022-11-10 9:24 ` Ondrej Kozina
2022-11-10 14:52 ` Philippe Cerfon
2022-11-11 10:39 ` Ondrej Kozina
2022-11-11 13:22 ` Philippe Cerfon
2022-11-11 18:11 ` Philippe Cerfon [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAN+za=OQGkWPiiket8_7kG3UgboDqTJ+-cdaBVoC4xdgSUQzww@mail.gmail.com' \
--to=philcerf@gmail.com \
--cc=cryptsetup@lists.linux.dev \
--cc=okozina@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).