ISO - cryptsetup Full Disk Encryption (FDE) - set more secure default encryption settings

Patrick · September 30, 2024, 8:45am

cryptsetup defaults:

cryptsetup --help

Default compiled-in device cipher parameters:
        loop-AES: aes, Key 256 bits
        plain: aes-cbc-essiv:sha256, Key: 256 bits, Password hashing: ripemd160
        LUKS: aes-xts-plain64, Key: 256 bits, LUKS header hashing: sha256, RNG: /dev/urandom
        LUKS: Default keysize with XTS mode (two internal keys) will be doubled.

More secure command currently documented on https://www.kicksecure.com/wiki/Full_Disk_Encryption:

sudo cryptsetup --verbose --use-random --cipher aes-xts-plain64 --key-size 512 --hash sha512 --use-random luksFormat

Differences - cryptsetup default versus hardened cryptsetup command line options:

TODO

Calamare (ISO installer used by Kicksecure) uses cryptsetup default settings.

Upstream issue, discussion:

github.com/calamares/calamares

What algorithm the "Encrypt system" is using, and where are the configuration options?

opened 09:46AM - 03 Jul 20 UTC

closed 05:47PM - 13 Sep 22 UTC

informer2016

Is there any possibility to choose the custom LUKS cryptsetup strong encryption …flags in a Calamares installer, like ```--verbose --type luks1 --cipher serpent-xts-plain64 --key-size 512 --hash whirlpool --iter-time 10000 --use-random --verify-passphrase luksFormat /dev/sdX2``` mentioned in this thread? [**Artix Linux** _(great Arch with OpenRC or runit/s6 instead of SystemD)_ - **Full Disk Encryption for a new install**](https://forum.artixlinux.org/index.php/topic,1541.0.html) Because, going through these lengthy manuals is time consuming and a bit intimidating for the new users, who would like a **much stronger encryption at cost of some performance.** Right now, Calamares just gives a **[ ] Encrypt system**, without any custom options or even a description of used encryption method! Would be nice if there'd be some button which **gives you a list of available encryption methods & options** : i.e. I had to figure out why a usual "serpent-xts" cryptsetup option didn't work in this time - now it seems to require something like -plain64 at the end

Dev todo:
ISO - calamares encryption settings

Patrick · October 2, 2024, 1:23pm

Patrick · October 6, 2024, 3:36pm

Was merged. Great work! @arraybolt3