On 06/10/2011 03:27, .. ink .. wrote : > On Wed, Oct 5, 2011 at 2:18 PM, .. ink .. <mhogomchungu@xxxxxxxxx> wrote: > >> >>>> >>>> It can now (from the GUI) >>>> 1. Create key files( 512 bytes in size composed of only the 94 printable >>>> characters). >>> >>> 512 bits rather than bytes ? >>> >>> >> i meant bytes, for 512 different characters. I just looked at the >> documentations and now i cant see why i went with this number since >> cryptsetup defaults to 256bits(32 bytes). >> >> Will change in the next version/update to create 32 bytes key files. >> >> >> just saw where i got the "512 bytes" from., running "cryptsetup --help" > gives a bunch of output and there is this output at the end. > > Default compiled-in keyfile parameters: > Maximum keyfile size: 8192kB, Maximum interactive passphrase length > 512 (characters) > > Default compiled-in device cipher parameters: > loop-AES: aes, Key 256 bits > plain: aes-cbc-essiv:sha256, Key: 256 bits, Password hashing: > ripemd160 > LUKS1: aes-cbc-essiv:sha256, Key: 256 bits, LUKS header hashing: > sha1, RNG: /dev/urandom > > Thats where i got the key file length from. Since my program interfaces with > cryptsetup interactively, i though creating a key file with the maximum size > allowed will be more secured. > > Whats the optimum key file size with the above output? > Whats the optimum key file size in general? > The above output seem to suggest 32 bytes files but whats the harm in using > 512 bytes?(the maximum allowed) As far as I now,, it depends on the command line invocation. If you give no parameter, I think you should use AES (not sure if the key is 128 or 256 bits). But you can change the cipher and key size with appropriate parameters, as well as the hash algorithm, ... provided your kernel has the adequate modules loaded. AES key size is either 128 or 256 bits, no more. But for example, if you use AES in XTS mode (with something like : --cipher=aes-xts-plain ) then you may use 512 bits keys. I'm not aware of longer keys, but not an expert of cryptsetup though. Best, Quentin _______________________________________________ dm-crypt mailing list dm-crypt@xxxxxxxx http://www.saout.de/mailman/listinfo/dm-crypt
