old cryptsetup default is es-cbc-essiv:sha256. the new one is aes-xts-plain64:sha256. i don't know that much about cryptography but i assume the standard was changed for a reason. also there can be found information like:

[...] if your device is still encrypted with the previous (cryptsetup <1.6.0) default cipher --cipher aes-cbc-essiv, more information leakage may occur from trimmed sector observation than with the current default.

so should i upgrade my old encrypted volumes?

bumped to the homepage by Community 15 hours ago

This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.


That depends, if you have a lot of very sensitive information in a large volume and you need to be as secure as possible then the answer is yes. Otherwise I'd say it is up to you, but I would not lose any sleep over it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.