3 ms·
tldr: LUKS2 and Argon are better than LUKS1 and PBKDF
by wiml 3y ago
tldr: LUKS2 and Argon are better than LUKS1 and PBKDF
- no_time 3y agoIs there any reason why LUKS and other data-at-rest encryption programs don't use the VeraCrypt method of key derivation? In VC you can choose one or more hash functions for key derivation. The trick is whichever you choose is not known to the attacker as this choice is never stored. Choosing anything other than the default one decimates brute force speed.
- deleted 3y ago[deleted]
- bawolff 3y agoThat's just a password with extra steps. If you're chosing from a family of good hash functions, then its like adding a few bits of security to your password. Better just to have a longer password. If you are choosing from arbitrary hash functions including bad ones, then this is an absolutely terrible idea. So basically its either a neutral or bad idea. I wouldn't reccomend it.
- zokier 3y agoIt boils down to https://en.wikipedia.org/wiki/Kerckhoffs%27s_principle https://en.wikipedia.org/wiki/Kerckhoffs%27s_principle In general cryptosystems are easier to analyze and design when the secret and open parts are clearly delineated. Having half-secret info like the choice of specific algorithm is problematic
- ChuckNorris89 3y agoCan anyone tell me why so many distros only offer LUKS instead of LUKS2 at installation phase?
- patrakov 3y agoTheir LUKS implementation defaults to LUKS2, because cryptsetup defaults to LUKS2. So it's just words. The only semi-valid reason nowadays to use LUKS1 is encryption of /boot for GRUB.