Hi Milan,

On Thu, 14 Mar 2019 at 19:22:42 +0100, Milan Broz wrote:
>>> I think diverging from upstream (and other distros) with respect to
>>> default algorithms requires careful consideration.  And in that case,
>>> compared to PBKDF2 Argon2 has interesting properties (such as resistance
>>> to GPU cracking) which would be a shame not to benefit from out of the
>>> box.
> For this case you need to specify PBKDF parameters directly and skip benchmark
> (these PBKDF options were added exactly for this use case).
> This problem is there even with PBKDF2 for the iterations time - on some
> IoT devices with LUKS device (formatted on developer's machine) the unlocking
> time increases to many minutes. (With Argon PBKDF it is just worse because 
> memory
> can be unavailable.)

Aha, you beat me to it :-)
>> I guess dracut with systemd in the initrd might be affected worse,
>> than initramfs-tools. I wonder if I should open a bug report in
>> systemd, to potentially execute luks2 unlock with some locking /
>> sequentially.
> FYI we know about that parallel unlocking problem already and we are trying
> to find (with systemd people) some solution (perhaps based on cgroups memory 
> limits
> and some locking).

Cool, do you have a link to refer to?  Couldn't find anything from a
quick glance at systemd's issue tracker.


Attachment: signature.asc
Description: PGP signature

Reply via email to