mirror of
https://github.com/ibm-s390-linux/s390-tools.git
synced 2026-08-05 02:14:52 +00:00
a69470d7e0
LUKS2 encrypted volumes use Argon2i as default password based key derivation function (PBKDF). Argon2i is a so-called memory-hard function. It requires a certain amount of physical memory to make dictionary attacks more costly. Unfortunately, when multiple encrypted volumes are unlocked automatically during system startup via /etc/crypttab, the use of Argon2i will most likely cause an out-of-memory error in systemd. To avoid the out-of-memory error, use PBKDF2 instead. Because PAES uses secure keys as volume keys, the security of the key derivation function used to derive the key to encrypt the volume key in the LUKS key slots is of less relevance. Thus it is safe to use a weaker key derivation function. Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com> Reviewed-by: Harald Freudenberger <freude@linux.ibm.com> Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>