docs/v1.6.5-ReleaseNotes

Cryptsetup 1.6.5 Release Notes
==============================

Changes since version 1.6.4

* Allow LUKS header operation handling without requiring root privilege.
  It means that you can manipulate with keyslots as a regular user, only
  write access to device (or image) is required.

  This requires kernel crypto wrapper (similar to TrueCrypt device handling)
  to be available (CRYPTO_USER_API_SKCIPHER kernel option).
  If this kernel interface is not available, code fallbacks to old temporary
  keyslot device creation (where root privilege is required).

  Note that activation, deactivation, resize and suspend operations still
  need root privilege (limitation of kernel device-mapper backend).

* Fix internal PBKDF2 key derivation function implementation for alternative
  crypto backends (kernel, NSS) which do not support PBKDF2 directly and have
  issues with longer HMAC keys.

  This fixes the problem for long keyfiles where either calculation is too slow
  (because of internal rehashing in every iteration) or there is a limit
  (kernel backend seems to not support HMAC key longer than 20480 bytes).

  (Note that for recent version of gcrypt, nettle or openssl the internal
  PBKDF2 code is not compiled in and crypto library internal functions are
  used instead.)

* Support for Python3 for simple Python binding.
  Python >= 2.6 is now required. You can set Python compiled version by setting
  --with-python_version configure option (together with --enable-python).

* Use internal PBKDF2 in Nettle library for Nettle crypto backend.
  Cryptsetup compilation requires Nettle >= 2.6 (if using Nettle crypto backend).

* Allow simple status of crypt device without providing metadata header.
  The command "cryptsetup status" will print basic info, even if you
  do not provide detached header argument.

* Allow to specify ECB mode in cryptsetup benchmark.

* Add some LUKS images for regression testing.
  Note that if image with Whirlpool fails, the most probable cause is that
  you have old gcrypt library with flawed whirlpool hash.
  Read FAQ section 8.3 for more info.

Cryptsetup API NOTE:
The direct terminal handling for passphrase entry will be removed from
libcryptsetup in next major version (application should handle it itself).

It means that you have to always either provide password in buffer or set
your own password callback function trhough crypt_set_password_callback().
See API documentation (or libcryptsetup.h) for more info.