eessppeelllloo/cryptsetup
1
0
Fork 0
mirror of https://gitlab.com/cryptsetup/cryptsetup.git synced 2025-12-13 11:50:10 +01:00
Code Issues Packages Projects Releases Wiki Activity

FAQ: add volume key example.

Browse Source 
And remove requests for private mails.
This commit is contained in:
Milan Broz
2025-05-11 21:20:44 +02:00
parent dd68e53082
commit 5f8cab5d4a
1 changed files with 7 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
FAQ.md
View File

@@ -705,9 +705,12 @@
this. The only legitimate reason I can think of is if you want to have this. The only legitimate reason I can think of is if you want to have
two LUKS devices with the same volume key. Even then, I think it would two LUKS devices with the same volume key. Even then, I think it would
be preferable to just use key-slots with the same passphrase, or to use be preferable to just use key-slots with the same passphrase, or to use
plain dm-crypt instead. If you really have a good reason, please tell plain dm-crypt instead.
me. If I am convinced, I will add how to do this here.
Use the --volume-key-file option, like this:
```
cryptsetup luksFormat --volume-key-file keyfile /dev/loop0
```
* **2.12 What are the security requirements for a key read from file?** * **2.12 What are the security requirements for a key read from file?**
@@ -1923,10 +1926,6 @@
Hence, LUKS has no kill option because it would do much more harm than Hence, LUKS has no kill option because it would do much more harm than
good. good.
Still, if you have a good use-case (i.e. non-abstract real-world
situation) where a Nuke-Option would actually be beneficial, please let
me know.
* **5.22 Does cryptsetup open network connections to websites, etc. ?** * **5.22 Does cryptsetup open network connections to websites, etc. ?**
@@ -2680,8 +2679,7 @@ can be converted to the raw volume key for example via:
Note that at the time this FAQ item was written, 1.5.4 was the latest Note that at the time this FAQ item was written, 1.5.4 was the latest
1.5.x version and it has the flaw, i.e. works with the old Whirlpool 1.5.x version and it has the flaw, i.e. works with the old Whirlpool
version. Possibly later 1.5.x versions will work as well. If not, version. Possibly later 1.5.x versions will work as well.
please let me know.
The only two ways to access older LUKS containers created with Whirlpool The only two ways to access older LUKS containers created with Whirlpool
are to either decrypt with an old gcrypt version that has the flaw or to are to either decrypt with an old gcrypt version that has the flaw or to
@@ -2797,8 +2795,7 @@ can be converted to the raw volume key for example via:
03) Creating your own initrd 03) Creating your own initrd
The two examples below should give you most of what is needed. This is The two examples below should give you most of what is needed. This is
tested with LUKS1 and should work with LUKS2 as well. If not, please tested with LUKS1 and should work with LUKS2 as well.
let me know.
Here is a really minimal example. It does nothing but set up some Here is a really minimal example. It does nothing but set up some
things and then drop to an interactive shell. It is perfect to try out things and then drop to an interactive shell. It is perfect to try out