LUKS/Advanced: Difference between revisions

(One intermediate revision by the same user not shown)

Line 49:

<code>argon2i 4 iterations, 735656 memory, 4 parallel threads (CPUs) for 256-bit key (requested 2000 ms time)</code>

<code>argon2id 4 iterations, 842046 memory, 4 parallel threads (CPUs) for 256-bit key (requested 2000 ms time)</code>

<code> Algorithm | Key | Encryption | Decryption</code>~~[[entropy]]~~

<code> Algorithm | Key | Encryption | Decryption</code>

<code> serpent-cbc 128b 59.8 MiB/s 371.1 MiB/s</code>

Line 65:

== [[Entropy]] ==

Though unlikely, to ~~avoid~~ an [[Entropy Starvation|entropy starved]] situation, you can use <code>--use-random</code> when setting up the disk.

Though unlikely, to mitigate an [[Entropy Starvation|entropy starved]] situation, you can use <code>--use-random</code> when setting up the disk. This tells cryptsetup to draw randomness from <code>/dev/random</code> instead of <code>/dev/urandom</code>. Simply put, the only difference between <code>/dev/random</code> and <code>/dev/urandom</code> is that <code>/dev/random</code> will wait until the kernel detects enough entropy has been gathered. If you are seriously worried about entropy starvation though, this may not be enough.

~~There's a lot~~ of ~~debate and conflicting information online about~~ the difference between <code>/dev/random</code> and <code>/dev/urandom</code> ~~online. The main difference~~ is that <code>/dev/random</code> will wait until it detects enough entropy has been gathered. ~~Since it only affects when~~ you ~~initially setup the disk~~ though, ~~waiting for it to gather enough entropy is generally a good idea. Whether its method of ensuring it has gathered~~ enough ~~data is effective, is also somewhat debated, but it certainly doesn't hurt~~.

An easy way to ensure you have enough entropy, is to gather it from an external source. For example, you can run: <code>curl -Ss <nowiki>https://www.random.org/cgi-bin/randbyte?nbytes=16384&format=f</nowiki> > /dev/random</code>. This command gathers random bytes from [https://random.org random.org]. Using an external source like this is ok, since Linux has ways to gather entropy besides this that an attacker would not be able to replicate.

@@ Line 49: / Line 49: @@
   <code>argon2i       4 iterations, 735656 memory, 4 parallel threads (CPUs) for 256-bit key (requested 2000 ms time)</code>
   <code>argon2id      4 iterations, 842046 memory, 4 parallel threads (CPUs) for 256-bit key (requested 2000 ms time)</code>
-  <code>    Algorithm |       Key |      Encryption |      Decryption</code>[[entropy]]
+  <code>    Algorithm |       Key |      Encryption |      Decryption</code>
   <code>      aes-cbc        128b       594.1 MiB/s      1434.3 MiB/s</code>
   <code>  serpent-cbc        128b        59.8 MiB/s       371.1 MiB/s</code>
@@ Line 65: / Line 65: @@
 == [[Entropy]] ==
-Though unlikely, to avoid an [[Entropy Starvation|entropy starved]] situation, you can use <code>--use-random</code> when setting up the disk.
+Though unlikely, to mitigate an [[Entropy Starvation|entropy starved]] situation, you can use <code>--use-random</code> when setting up the disk. This tells cryptsetup to draw randomness from <code>/dev/random</code> instead of <code>/dev/urandom</code>. Simply put, the only difference between <code>/dev/random</code> and <code>/dev/urandom</code> is that <code>/dev/random</code> will wait until the kernel detects enough entropy has been gathered. If you are seriously worried about entropy starvation though, this may not be enough.
-There's a lot of debate and conflicting information online about the difference between <code>/dev/random</code> and <code>/dev/urandom</code> online. The main difference is that <code>/dev/random</code> will wait until it detects enough entropy has been gathered. Since it only affects when you initially setup the disk though, waiting for it to gather enough entropy is generally a good idea. Whether its method of ensuring it has gathered enough data is effective, is also somewhat debated, but it certainly doesn't hurt.
 An easy way to ensure you have enough entropy, is to gather it from an external source. For example, you can run: <code>curl -Ss <nowiki>https://www.random.org/cgi-bin/randbyte?nbytes=16384&format=f</nowiki> > /dev/random</code>. This command gathers random bytes from [https://random.org random.org]. Using an external source like this is ok, since Linux has ways to gather entropy besides this that an attacker would not be able to replicate.

LUKS/Advanced: Difference between revisions

CRYSTL (talk | contribs)