old cryptsetup default is es-cbc-essiv:sha256. the new one is aes-xts-plain64:sha256. i don't know that much about cryptography but i assume the standard was changed for a reason. also there can be found information like:

[...] if your device is still encrypted with the previous (cryptsetup <1.6.0) default cipher --cipher aes-cbc-essiv, more information leakage may occur from trimmed sector observation than with the current default.

so should i upgrade my old encrypted volumes?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.