6

I have a couple of dm-crypt/LUKS related questions.

Setting up dm-crypt/LUKS with these settings:

cryptsetup -c aes-xts-plain -h sha256 --key-size=256 -y luksFormat /dev/sda1

(1) Considering the key size specified is 256 bits, how many characters long should the passphrase be? And if for some reason the size may vary, why? And what is the recommended size?

When using a key file with these settings (or alternatively adding one to an available slot):

cryptsetup -c aes-xts-plain -h sha256 --key-size=256 luksFormat /dev/sda1 /path/to/key/file

(2) What size should the key file be? And again, if the size may vary, why, and what is recommended?

(3) What is the difference between --key-size=BITS and --keyfile-size=bytes?

I know one means "The size of the encryption key" and one "Limits the read from keyfile", but I don't understand the exact corelation between them.

(4) ...and between --keyfile-size=bytes and --new-keyfile-size=bytes?

I read the man page multiple times, and researched the Internet reading many different articles. These are just a couple of things that confuse me.

Improve this question
1

1 Answer 1

Reset to default
4

(1) Considering the key size specified is 256 bits, how many characters long should the passphrase be? And if for some reason the size may vary, why? And what is the recommended size?

It should be as long as you can reasonably remember and you are willing to type. It is run through a hash function, but it will stop reading after the first newline \n. The hash function takes as much text as you give it, then gives a result.

The sha256 hash for the text superuser.com is 6153a5e4835cfb92fa324bfce5470a0b8d554cadbf7a9fbe21be74460897e021, and the hash for the entire body text of the first version of your question is f653459aa401efd1f058de5920cb25fe03bb969c90b001fd0f5282164c8b1afa, notice how the output is the same length.

(2) What size should the key file be? And again, if the size may vary, why, and what is recommended?

Normally LUKS will only use the amount of data from the file that it actually needs. So you could use a 1GB file, and if your key-size=256 then it will only use the first 256 bits. So your keyfile should be at least as big as your key-size value, but it may be bigger. I tend to just create a 4096 byte keyfile by using a command like dd if=/dev/random of=/../mykeyfile bs=4096 count=1. This gives you more data then you need, but it is still a relatively small file.

(3) What is the different between --key-size=BITS and --keyfile-size=bytes?

I am not sure which version of cryptsetup you are running, the keyfile-size option appears to be new. The note in the release notes seems to suggest that it is present to make LUKS read more data from the file then what you key-size value is.

Improve this answer
5
  • 2
    --keyfile-size is likely for if you aren't reading the "keyfile" from an actual file, but something like a socket or fifo.
    – LawrenceC
    Jul 21, 2011 at 2:28
  • Are you sure that it only uses the first 256 bits of a keyfile (assuming key-size=256)? If so, then why would you create a file of 32768 bits??
    – Carlo Wood
    May 18, 2020 at 0:36
  • 1
    I didn't create a file that is 32,768 bits?
    – Zoredache
    May 18, 2020 at 16:43
  • 1
    @Zoredache : > Normally LUKS will only use the amount of data from the file that it actually needs. Are you sure about this ? And what if you use a regular file as a keyfile, instead of a truly random one ? I think LUKS allows the use of bigger keyfiles (up to 8 MiB) to compensate the lack of randomness in the case you use a non random keyfile. But that's just my understanding, I couldn't find more infos on that.
    – ChennyStar
    Mar 11, 2023 at 4:39
  • @ChennyStar I am probably read that in a docs somewhere, but that would have been reading would have over ~12 years old now. The current docs seem to suggest I may be wrong here. I wouldn't be surprised if things have changed or what I was reading was wrong. If you have a more accurate answer feel free to either edit my post, or add your own answer with more details.
    – Zoredache
    Mar 11, 2023 at 19:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .