http://bugzilla.suse.com/show_bug.cgi?id=920204 Bug ID: 920204 Summary: YaST2 installer: increase master key size of LUKS volumes using XTS mode Classification: openSUSE Product: openSUSE Factory Version: 201502* Hardware: Other OS: Other Status: NEW Severity: Enhancement Priority: P5 - None Component: YaST2 Assignee: yast2-maintainers@suse.de Reporter: astieger@suse.com QA Contact: jsrain@suse.com Found By: --- Blocker: --- The YaST installer is able to create an encrypted root / encrypted LVM, using LUKS in the backend. The compiled-in defaults for cryptsetup with LUKS are aes-xts-plain64 with 256 bits for the master key.

cryptsetup --help [...] LUKS1: aes-xts-plain64, Key: 256 bits, LUKS header hashing: sha1, RNG: /dev/urandom

However XTC mode is documented to cause the effective key size to be only 128 bits for AES:

From https://code.google.com/p/cryptsetup/wiki/FrequentlyAskedQuestions Note that XTS mode takes two keys, hence the listed key sizes are double that for other modes and half of it is the cipher key, the other half is the XTS key.

From man cryptsetup: For XTS mode you can optionally set a key size of 512 bits with the -s option. Key size for XTS mode is twice that for other modes for the same security level.

For users previously using cbc with 256 bits this may be considered a regression in terms of security $ cryptsetup luksDump /dev/sda2

[...] MK bits: 256 [...]

The YaST2 installer should pass --key-size 512, or a maximum read from /proc/crypto, or offer a configuration option. This relates to https://features.opensuse.org/313003 -- You are receiving this mail because: You are on the CC list for the bug.