4 ms·

I still don't get how the fix works. If I just mount an external LUKS2 device in an updated system, It's good to go?

• frankjr 5y ago
  The way I understand it the reencryption process now requires additional digest of reencryption metadata. This digest cannot be calculated without knowledge of the passphrase. This means that the attacker can still modify the metadata but cryptsetup will scream loudly when you try to open the device because the digest will be incorrect/missing. So yes, updating the package should be all that's required.