On 28/12/2019 09:08, huxiaoyu@xxxxxxxxxxxx wrote:
SM3/4 is a block cipher similar to DES and AES, and has been supported by openSSL rencently. Does dm-crypt (LUKS) support the use of SM3/SM4? and if yes, how to
Hi,
SM3 is a hash function, if userspace backend (usually OpenSSL) supports it, you can use it
for header hash ans anti-forensic funciton, you can try it with benchmark, for example:
cryptsetup benchmark --pbkdf pbkdf2 --hash sm3 --key-size 128
# Tests are approximate using memory only (no storage IO).
PBKDF2-sm3 1076566 iterations per second for 128-bit key
SM4 is a block cipher, if kernel crypto supports it (for dm-crypt, recent kernel contains the module),
you can use it for data encryption, again, you can check support using benchmark, for example:
cryptsetup benchmark --cipher sm4-xts-plain64 --key-size 256
# Tests are approximate using memory only (no storage IO).
# Algorithm | Key | Encryption | Decryption
sm4-xts 256b 40.3 MiB/s 40.1 MiB/s
So, both are easily used in LUKS format:
cryptsetup luksFormat --cipher sm4-xts-plain64 --key-size 256 --hash sm3 <device>
Note, that not all crypto backends and kernel support it, also I have no idea
how it is secure and if there is any analysis of these Chinese algorithms in the FDE context.
Anyway, it works out of the box, at least on my Debian system.
Milan
_______________________________________________
dm-crypt mailing list
dm-crypt@xxxxxxxx
https://www.saout.de/mailman/listinfo/dm-crypt
