Timeline for For LUKS: The most preferable and safest cipher?
Current License: CC BY-SA 3.0
14 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Feb 20, 2019 at 9:00 | history | tweeted | twitter.com/StackSecurity/status/1098145334495272960 | ||
| Feb 20, 2019 at 4:25 | comment | added | forest | @refex SHA-512 is a better choice since it is (paradoxically) faster than SHA-256 on 64-bit processors. | |
| Feb 19, 2019 at 14:12 | answer | added | arif | timeline score: 11 | |
| Feb 9, 2017 at 12:31 | comment | added | user |
You should always use plain64 rather than plain. The two are identical for volume sizes up to 2 TiB, but plain can potentially leak data when volume sizes grows beyond 2 TiB whereas plain64 does not. Since plain64 is identical to plain for offsets below the 2 TiB mark, there is no real reason to use plain in favor of plain64. The cryptsetup FAQ has a discussion on this under Are there any problems with "plain" IV? What is "plain64"? (currently section 5.15).
|
|
| Aug 19, 2016 at 21:43 | comment | added | refex | I suggest to pay attention at the Key Derivation process as well: the master key will be encrypted with a key derived from your user password/passphrase (if not keyfile). Thus either you provide a really strong passphrase (correct-horse-battery-staple level: xkcd.com/936), either you pay more attention to the parameters used in deriving this user key. In particular look at: iteration count, hashing pseudo-random-function. I suggest > 1M i.c. if on laptop, or more, and SHA256. Now I see the age of this question, my comment is valid for the current versions of LUKS. | |
| Apr 5, 2016 at 5:31 | comment | added | forest | In terms of the cipher alone, Serpent is generally agreed upon to be the most secure common cipher for LUKS. Note that the mode of operation (e.g. xts, cbc-essiv:sha256, etc) is highly dependent on your use case, so I won't go into that here. | |
| Oct 9, 2014 at 20:19 | comment | added | Martin Schröder | See also How secure is Ubuntu's default full-disk encryption? | |
| Aug 28, 2012 at 10:47 | answer | added | user2213 | timeline score: 23 | |
| Aug 26, 2012 at 10:31 | history | edited | Gilles 'SO- stop being evil' | CC BY-SA 3.0 |
deleted 16 characters in body; edited tags
|
| Jul 12, 2011 at 16:29 | comment | added | user2122 | If you'd like more comprehensive answers, then perhaps you could list the ciphers supported by LUKS by their common names. I don't know which ciphers LUKS support, and I imageine others here have it the same way. | |
| Jul 11, 2011 at 23:51 | history | edited | AviD♦ |
edited tags
|
|
| Jul 11, 2011 at 20:53 | history | edited | nealmcb | CC BY-SA 3.0 |
for the uninitiated: clarify in title you want a cipher to use with LUKS, not that LUKS is the safest cipher
|
| Jul 11, 2011 at 13:48 | answer | added | Rory Alsop♦ | timeline score: 9 | |
| Jul 11, 2011 at 13:31 | history | asked | Peter | CC BY-SA 3.0 |