On 02/18/2011 06:59 PM, Eric Bauman wrote: > I'm interested in the difference between, --hash sha256 and --cipher > whatever:sha256. Hi, For LUKS mode (luksFormat / luksOpen): --hash is for LUKS header hash (by default is it sha1), IOW the hash used for anti-forensic splitter and volume key obfuscation (passphrase is used to unlock LUKS keyslots whe is volume key stored. Volume key is always generated from random generator during format.) sha256 in cipher specification is useful only for ESSIV initialization vector. e.g. aes-cbc-essiv:sha256 - means cipher AES in CBC mode and with ESSIV initialization vector which uses sha256 (IV is derived from key using sha256 hash). (For othes modes, like XTS, you do not need to use ESSIV because the problem of predictable IV is solved by mode itself - so you can have e.g. aes-xts-plain64. For LUKS header you must use some hash always. It is part of the specification - for more info see project pages http://code.google.com/p/cryptsetup/ - specification bookmark.) For plain mode (cryptsetup create command): --hash means which hash alg. will be used to generate key. (passphrase is hashed and its output is directly used as key). cipher specification is the same as in LUKS mode. Milan _______________________________________________ dm-crypt mailing list dm-crypt@xxxxxxxx http://www.saout.de/mailman/listinfo/dm-crypt
