luks2 in the dm-crypt command

[Junien F]

Hi,

Currently, if your machine doesn't support zkey, curtin uses type "luks" in the dm-crypt command, and there's no way to change that.
Could we add an "type" option to allow instructing curtin to use type "luks2" instead of "luks" ?

Or perhaps make "luks2" the default ?

Thanks

[Ryan Harper (raharper)]

Thanks for filing the bug.

The dm_crypt storage config could add a luks_type field.

We'll need to discuss whether to support the additional types, plain, loopaes, tcrypt, bitlk
And even for just luks2, determine what, if any additional values need to be provided, specifically

[--integrity, --integrity-no-wipe, --sector-size, --label, --subsystem,
  --pbkdf, --pbkdf-memory, --pbkdf-parallel, --disable-locks, --disable-keyring, --luks2-metadata-size,
  --luks2-keyslots-size, --keyslot-cipher, --keyslot-key-size]

Likely we'd want to select some best practice defaults and
not expose all of these options initially.

[Pawel (cryptonix)]

Hi, I think the bug is no longer present.

Currently cryptsetup use LUKS2 as a default. I assume curtin just follows this default, as using luksDump on device created by curtin clearly shows it uses LUKS2. At least on Ubuntu 20.04.2.

[Josef Wolf (jw-raven)]

Grub can (currently) not open luks2 volumes. For this, having an option to fall back to luks1 would probably be a good idea, though.

[Junien F (axino)]

@jw-raven : upstream grub gained LUKS2 support in early 2020 : https://git.savannah.gnu.org/cgit/grub.git/commit/?id=365e0cc3e7e44151c14dd29514c2f870b49f9755