| Cryptsetup 1.1.0 Release Notes | |
| ============================== | |
| Changes since version 1.0.7 | |
| ---------------------------- | |
| Important changes: | |
| ~~~~~~~~~~~~~~~~~~ | |
| * IMPORTANT: the default compiled-in cipher parameters changed | |
| plain mode: aes-cbc-essiv:sha256 (default is backward incompatible!). | |
| LUKS mode: aes-cbc-essiv:sha256 (only key size increased) | |
| In both modes is now default key size 256bits. | |
| * Default compiled-in parameters are now configurable through configure options: | |
| --with-plain-* / --with-luks1-* (see configure --help) | |
| * If you need backward compatible defaults for distribution use | |
| configure --with-plain-mode=cbc-plain --with-luks1-keybits=128 | |
| Default compiled-in modes are printed in "cryptsetup --help" output. | |
| * Change in iterations count (LUKS): | |
| The slot and key digest iteration minimum count is now 1000. | |
| The key digest iteration count is calculated from iteration time (approx 1/8 of req. time). | |
| For more info about above items see discussion here: http://tinyurl.com/yaug97y | |
| * New libcryptsetup API (documented in libcryptsetup.h). | |
| The old API (using crypt_options struct) is still available but will remain | |
| frozen and not used for new functions. | |
| Soname of library changed to libcryptsetup.so.1.0.0. | |
| (But only recompilation should be needed for old programs.) | |
| The new API provides much more flexible operation over LUKS device for | |
| applications, it is preferred that new applications will use libcryptsetup | |
| and not wrapper around cryptsetup binary. | |
| * New luksHeaderBackup and luksHeaderRestore commands. | |
| These commands allows binary backup of LUKS header. | |
| Please read man page about possible security issues with backup files. | |
| * New luksSuspend (freeze device and wipe key) and luksResume (with provided passphrase). | |
| luksSuspend wipe encryption key in kernel memory and set device to suspend | |
| (blocking all IO) state. This option can be used for situations when you need | |
| temporary wipe encryption key (like suspend to RAM etc.) | |
| Please read man page for more information. | |
| * New --master-key-file option for luksFormat and luksAddKey. | |
| User can now specify pre-generated master key in file, which allows regenerating | |
| LUKS header or add key with only master key knowledge. | |
| * Uses libgcrypt and enables all gcrypt hash algorithms for LUKS through -h luksFormat option. | |
| Please note that using different hash for LUKS header make device incompatible with | |
| old cryptsetup releases. | |
| * Introduces --debug parameter. | |
| Use when reporting bugs (just run cryptsetup with --debug and attach output | |
| to issue report.) Sensitive data are never printed to this log. | |
| * Moves command successful messages to verbose level. | |
| * Requires device-mapper library and libgcrypt to build. | |
| * Uses dm-uuid for all crypt devices, contains device type and name now. | |
| * Removes support for dangerous non-exclusive option | |
| (it is ignored now, LUKS device must be always opened exclusive) | |
| Other changes: | |
| ~~~~~~~~~~~~~~ | |
| * Fixed localization to work again. Also cryptsetup is now translated by translationproject.org. | |
| * Fix some libcryptsetup problems, including | |
| * exported symbols and versions in libcryptsetup (properly use versioned symbols) | |
| * Add crypt_log library function. | |
| * Add CRYPT_ prefix to enum defined in libcryptsetup.h. | |
| * Move duplicate Command failed message to verbose level (error is printed always). | |
| * Fix several problems in build system | |
| * use autopoint and clean gettext processing. | |
| * Check in configure if selinux libraries are required in static version. | |
| * Fix build for non-standard location of gcrypt library. | |
| * Add temporary debug code to find processes locking internal device. | |
| * Fix error handling during reading passphrase. | |
| * Fail passphrase read if piped input no longer exists. | |
| * Fix man page to not require --size which expands to device size by default. | |
| * Clean up Makefiles and configure script. | |
| * Try to read first sector from device to properly check that device is ready. | |
| * Move memory locking and dm initialization to command layer. | |
| * Increase priority of process if memory is locked. | |
| * Add log macros and make logging more consistent. | |
| * Keyfile now must be provided by path, only stdin file descriptor is used (api only). | |
| * Do not call isatty() on closed keyfile descriptor. | |
| * Move key slot manipulation function into LUKS specific code. | |
| * Replace global options struct with separate parameters in helper functions. | |
| * Implement old API calls using new functions. | |
| * Allow using passphrase provided in options struct for LuksOpen. | |
| * Allow restrict keys size in LuksOpen. | |
| * Fix errors when compiled with LUKS_DEBUG. | |
| * Print error when getline fails. | |
| * Completely remove internal SHA1 implementation code, not needed anymore. | |
| * Pad luks header to 512 sector size. | |
| * Rework read/write blockwise to not split operation to many pieces. | |
| * Use posix_memalign if available. | |
| * Fix segfault if provided slot in luksKillslot is invalid. | |
| * Remove unneeded timeout when remove of temporary device succeeded. |