On Sat, 12 Jul 2025 at 15:21, Guilhem Moulin <guil...@debian.org> wrote: > > On Sat, 12 Jul 2025 at 14:52:13 +0100, Richard Lewis wrote: > > I think what i understand from this (which may be very wrong) is: > > > > The default settings for LUKS filesystems (see crypttab(5)) have > > changed to improve security, which may cause issues if you did not > > No, the new defaults affect plain dm-crypt devices only (aka plain > mode), Algorithms for LUKS remain unchanged for Bookworm → Trixie. >
aha -- i had not understood that there was a difference, so i have learned something (not east what a terrible design decision was made with plain-mode!). I think the version below might be more accurate -- but can we tell people to record the keysize while we are at it - crypttab(5) mentions this is also needed, but doesnt give any hints as to the default values themselves! even though keysize did not change in trixie, telling people to add it now may avoid future issues (assuming anyone reads the release-notes) change to default encryption settings for plain-mode dm-crypt devices ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ The default settings for ``dm-crypt`` devices created using with ``plain``-mode encryption (see :url-man-stable:`crypttab(5)) have changed to improve security. This will cause problems if you did not record the settings used in ``/etc/crypttab``. The only recommended way to configure plain-mode devices is to record the ``cipher``, ``hash`` and ``keysize`` options in ``/etc/crypttab``, but it is possible to rely on `cryptsetup` using default values. Because the default values for cipher and hash algorithm have changed in trixie, such poorly-configured devices will not be accessible until you properly configure them. This does not apply to LUKS devices because LUKS records the settings in the device itself. To properly configure your plain-mode devices, assuming they were created with the bookworm defaults, you should add ``cipher=aes-cbc-essiv:sha256,hash=ripemd160`` to ``/etc/crypttab``. To access such devices with ``cryptsetup`` on the command line you can use ``--cipher aes-cbc-essiv:sha256 --hash ripemd160``. Debian recommends you do not use plain mode for non-transient devices, and that if you do use them, you should explicitly record all the encryption settings used in ``/etc/crypttab``. The new defaults are ``cipher=aes-xts-plain64,hash=sha256``.
