Gentoo Forums
Gentoo Forums
Gentoo Forums
Quick Search: in
[SOLVED] Requested LUKS hash PBKDF2-sha256 is not supported.
View unanswered posts
View posts from last 24 hours

 
Reply to topic    Gentoo Forums Forum Index Networking & Security
View previous topic :: View next topic  
Author Message
Apheus
Guru
Guru


Joined: 12 Jul 2008
Posts: 418

PostPosted: Wed Aug 10, 2016 11:12 am    Post subject: [SOLVED] Requested LUKS hash PBKDF2-sha256 is not supported. Reply with quote

I always encrypt my partitions, usually with hash "ripemd160". However, I want to try PBKDF2 on a new partition:

Code:
cryptsetup luksFormat -c aes-xts-plain64 -h PBKDF2-sha256 -s 256 /dev/sda1 <keyfile>


The result:

Code:
WARNING!
========
This will overwrite data on /dev/sda1 irrevocably.

Are you sure? (Type uppercase yes): YES
Requested LUKS hash PBKDF2-sha256 is not supported.


It is shown by "cryptsetup benchmark":

Code:
# cryptsetup benchmark
# Tests are approximate using memory only (no storage IO).
PBKDF2-sha1      1219274 iterations per second
PBKDF2-sha256     837520 iterations per second
PBKDF2-sha512     672164 iterations per second
PBKDF2-ripemd160  774428 iterations per second
PBKDF2-whirlpool  312076 iterations per second
#  Algorithm | Key |  Encryption |  Decryption
     aes-cbc   128b   715.6 MiB/s  3026.9 MiB/s
 serpent-cbc   128b    97.5 MiB/s   611.7 MiB/s
 twofish-cbc   128b   201.9 MiB/s   389.5 MiB/s
     aes-cbc   256b   529.5 MiB/s  2339.0 MiB/s
 serpent-cbc   256b    97.7 MiB/s   612.0 MiB/s
 twofish-cbc   256b   202.7 MiB/s   389.5 MiB/s
     aes-xts   256b  2579.9 MiB/s  2565.6 MiB/s
 serpent-xts   256b   611.5 MiB/s   594.4 MiB/s
 twofish-xts   256b   378.6 MiB/s   386.0 MiB/s
     aes-xts   512b  1992.9 MiB/s  1977.0 MiB/s
 serpent-xts   512b   612.6 MiB/s   594.1 MiB/s
 twofish-xts   512b   379.1 MiB/s   384.8 MiB/s


I cannot find anything "PBKDF2" in kernel config.

"ripemd160" works.

kernel 4.4.6-gentoo, sys-fs/cryptsetup-1.6.5, amd64 system.

What is necessary to get PBKDF2 working?

Thanks.


Last edited by Apheus on Wed Aug 10, 2016 2:33 pm; edited 1 time in total
Back to top
View user's profile Send private message
freke
Guru
Guru


Joined: 23 Jan 2003
Posts: 402
Location: Somewhere in Denmark

PostPosted: Wed Aug 10, 2016 12:49 pm    Post subject: Reply with quote

It's not just "sha256"? (If "ripemd160" equals PBKDF2-ripemd160?)
Back to top
View user's profile Send private message
frostschutz
Advocate
Advocate


Joined: 22 Feb 2005
Posts: 2968
Location: Germany

PostPosted: Wed Aug 10, 2016 2:08 pm    Post subject: Reply with quote

PBKDF is implied... you probably want -h sha512, not that it matters much. [this only affects passphrase, not data encryption]

default should be fine too ( aes-xts-plain64, sha1 ) so you just don't have to specify these options with recent cryptsetup
Back to top
View user's profile Send private message
Apheus
Guru
Guru


Joined: 12 Jul 2008
Posts: 418

PostPosted: Wed Aug 10, 2016 2:32 pm    Post subject: Reply with quote

Thank you. With your answers and some wikipedia reading, I know now that i confused the terms "cryptographic hash function" and "key derivation function". Both must be combined, and cryptsetup always uses PBKDF2 as key derivation function.
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Gentoo Forums Forum Index Networking & Security All times are GMT
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum