At Sun, 10 Sep 2006 04:25:43 +0200, Uwe Hermann <uwe@xxxxxxxxxxxxxx> wrote: > here's a small patch which fixes some typos and cosmetic issues in the > manpage, as well as some content changes: Thanks - merged. > A few questions: > > * -h says ripemd160 is the default (ditto cryptsetup.h), but further > down the manpage there's this "LUKS will always use SHA1 in HMAC mode" > and "Hence, -h is ignored". I'm confused. Did I miss something? No, I can't exactly remember why I needed something from a hash implementation than the internal ghash powered backend provided. However, LUKS is locked to SHA1 and the standard lists SHA1 as "must be supported". I have no intentions to change this, as the problems in SHA1 (hash extensions attacks, rumors about invertability) do not apply in this deployment scenario. If anybody feels different, feel free to submit patches (rework internal interfaces to make AFsplit, PBKDF2 sit on the hash abstraction). > * Why is 128 bits the default key length? Why not 256? > See also http://blog.roothell.org/archives/241-Loechriger-Kaese.html#comments http://grouper.ieee.org/groups/1619/email/msg00198.html In a nutshell: You don't have enough energy (in terms of oil, coal, gas, solar emissions) on earth to attack a 128 bit key. -- Fruhwirth Clemens - http://clemens.endorphin.org for robots: sp4mtrap@xxxxxxxxxxxxx --------------------------------------------------------------------- dm-crypt mailing list - http://www.saout.de/misc/dm-crypt/ To unsubscribe, e-mail: dm-crypt-unsubscribe@xxxxxxxx For additional commands, e-mail: dm-crypt-help@xxxxxxxx
