Wenn jemand ein Linux-System mit LUKS verschlüsselt betreibt, könnte es sein, dass eine zu schwache (und veraltete) Key Derivation Function verwendet wird - vor allem, wenn die Installation schon etwas her ist.

Hier gibt's mehr Informationen und auch eine (von mir erfolgreich getestete) Anleitung zum Aktualisieren der LUKS-Einstellungen von @mjg59:
https://mjg59.dreamwidth.org/66429.html

#linux #luks #verschluesselung #encryption #pbkdf2 #argon2id

@mjg59

Thank you for sounding the alert!

I identified a minor issue with your otherwise nice explanation: According to my sources (man cryptsetup, #rfc9106), all #argon2 varieties are memory-hard. RFC 9106 is even titled “Argon2 Memory-Hard Function for Password Hashing and Proof-of-Work Applications”.

However, given that there are known attacks against #argon2i, it seems wise to use #argon2id instead. It is also what is recommended in the RFC.

As a #QubesOS user, I just checked the state of affairs there:

The cryptsetup that comes with QubesOS 3.x used #luks1, and those who did an in-place upgrade to 4.x still have that unless they converted to #luks2 manually (as detailed in the migration guide).

The cryptsetup in QubesOS 4.x uses #luks2, but it still defaults to #argon2i unfortunately.

KeePassXC 2.6.3 Password Manager Adds Support for Argon2id KDF and XMLv2 Key Files

https://9to5linux.com/keepassxc-2-6-3-password-manager-adds-support-for-argon2id-kdf-and-xmlv2-key-files

#KeePassXC #passwordmanager #Argon2id