get this at a current hardened system in rc.log: * Setting up dm-crypt mappings ... * crypt-swap using: -c aes -h sha1 -d /dev/urandom create crypt-swap /dev/sda2 ... WARNING: The --hash parameter is being ignored in plain mode with keyfile specified. [ ok ] with these settings : # grep -v -e '#' -e '^$' /etc/conf.d/dmcrypt swap=crypt-swap source='/dev/sda2'
From upstream (https://gitlab.com/cryptsetup/cryptsetup/issues/343#note_40201575O) : "The warning is needed - the keyfile is in plain mode used directly (without hashing) for backward compatible reasons." I do wonder if the default are fine here in Gentoo -or- if they should change ?
