| Cryptsetup 1.6.4 Release Notes | |
| ============================== | |
| Changes since version 1.6.3 | |
| * Implement new erase (with alias luksErase) command. | |
| The erase cryptsetup command can be used to permanently erase | |
| all keyslots and make the LUKS container inaccessible. | |
| (The only way to unlock such device is to use LUKS header backup | |
| created before erase command was used.) | |
| You do not need to provide any password for this operation. | |
| This operation is irreversible. | |
| * Add internal "whirlpool_gcryptbug hash" for accessing flawed | |
| Whirlpool hash in gcrypt (requires gcrypt 1.6.1 or above). | |
| The gcrypt version of Whirlpool hash algorithm was flawed in some | |
| situations. | |
| This means that if you used Whirlpool in LUKS header and upgraded | |
| to new gcrypt library your LUKS container become inaccessible. | |
| Please refer to cryptsetup FAQ for detail how to fix this situation. | |
| * Allow to use --disable-gcrypt-pbkdf2 during configuration | |
| to force use internal PBKDF2 code. | |
| * Require gcrypt 1.6.1 for imported implementation of PBKDF2 | |
| (PBKDF2 in gcrypt 1.6.0 is too slow). | |
| * Add --keep-key to cryptsetup-reencrypt. | |
| This allows change of LUKS header hash (and iteration count) without | |
| the need to reencrypt the whole data area. | |
| (Reencryption of LUKS header only without master key change.) | |
| * By default verify new passphrase in luksChangeKey and luksAddKey | |
| commands (if input is from terminal). | |
| * Fix memory leak in Nettle crypto backend. | |
| * Support --tries option even for TCRYPT devices in cryptsetup. | |
| * Support --allow-discards option even for TCRYPT devices. | |
| (Note that this could destroy hidden volume and it is not suggested | |
| by original TrueCrypt security model.) | |
| * Link against -lrt for clock_gettime to fix undefined reference | |
| to clock_gettime error (introduced in 1.6.2). | |
| * Fix misleading error message when some algorithms are not available. | |
| * Count system time in PBKDF2 benchmark if kernel returns no self usage info. | |
| (Workaround to broken getrusage() syscall with some hypervisors.) |