On Fri, 24 Jul 2026 at 12:08, Barry Scott <[email protected]> wrote: > > > > On 24 Jul 2026, at 11:15, Peter Robinson <[email protected]> wrote: > > - there's no xts mode implemented for camellia, serpent and twofish > ciphers in openssl (I mention only the most used AES alternatives). So > the cryptsetup (in Fedora) will loose userspace access to those ciphers > without CAP_SYS_ADMIN. Affects LUKS2. > > > Can you provide details of where they are used in Fedora? I believe > these would only be used if a user when out of their way to use those, > generally via a manual install process. > > > I'm one of the people that has done manual setup with a cypher that is > affected. > > On a Rpi4 I have a luks2 vault that I setup with advice from the *internet* > that advised to > use these setting as the Rpi would strugle with the defaults.
The internet wasn't entirely correct, the rpi3/4 are the only devices I'm aware of that don't have the complete aarch64 crypto extensions but there's been a lot of work done upstream to make them decent using NEON. > Cipher: aes-xts-plain64 > PBKDF: argon2id Those are the defaults, what did you actually use? > Clearly I will have to migrate to a supported cypher before upgrading to f45. Well not for f45 but before long. -- _______________________________________________ devel mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/[email protected] Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
