Milan Broz b0821b11a5 Add the same cipher_null restriction to LUKS2 keyslot as in LUKS1. ...

LUKS2 keyslot cannot be created with cipher_null using standard
tools, but activation of such a keyslot is allowed.

As this can be confusing and create a false sense of security,
let's apply the same restriction as in LUKS1 - such a keyslot
is used only with an empty passphrase.

This will reject activation with a real password, avoiding
possible activation of insecure LUKS containers.

Fixes: #954

2025-08-18 08:22:51 +02:00

24 KiB

Raw Blame History

View Raw