Skip to content

v1.4.0 — KDF tuning after installation, and corrected cost figures

Choose a tag to compare

View all tags
@doug445 doug445 released this 23 Aug 02:42
· 91 commits to main since this release
v1.4.0
5add5e2

v1.4.0 — KDF tuning after installation, and corrected cost figures

Adds a way to change your mind about the KDF once the disk is already
encrypted, and fixes two things the previous release stated wrongly.

Post-installation tuning

  • New README section after the verification step: four ready-to-paste
    cryptsetup luksConvertKey commands covering fast, moderate, aggressive
    and a new documented-only paranoid tier at 4 GiB / 12 iterations. The
    installer still ships three profiles; 12 iterations is a deliberate
    choice, not a default. All four were verified against a loopback
    volume - each writes exactly the requested parameters, and the
    passphrase still opens the volume afterwards.
  • New bin/luks-tune.sh: an ncurses front end for the same operation.
    Backs the header up before any write, shows the measured unlock time
    and a strength table for whatever you pick before you commit, and
    hands the passphrase prompt to cryptsetup rather than reading it.
    Never creates or destroys a keyslot and never touches data.

Corrected claims

  • 4 GiB is argon2id's MAXIMUM memory cost, a hard cryptsetup limit that
    rejects anything above 4194304 KiB. v1.3.0 documentation implied it
    was a property of how much RAM an 8 GiB Mac can spare. It is not, and
    the wrong reason would have misled anyone with more memory into
    thinking they could go higher.
  • Unlock cost tracks memory TIMES iterations, not memory alone. Measured
    from the boot journal on an M2 Max, argon2id at 4 GiB / 10 iterations
    costs 9.5 s, consistent to +/-0.1 s across three boots - and only
    about 1 s of that is the 4 GiB. Documentation that called a large
    memory figure "deliberately expensive" has been corrected throughout.

Profile changes

  • aggressive 4 GiB t=10 (unchanged in effect; t=12 was tried during
    development and reverted), moderate 2 GiB t=8 -> t=6.

Guidance

  • New sections on passphrase generation with diceware, on why a
    memory-hard KDF is not optional, and on what Grover's algorithm does
    and does not change. Every figure in them is derived from the measured
    per-guess cost rather than asserted.
Assets 2
Loading