Bug 619048

Summary:	sys-fs/cryptsetup-1.7.4: do not use hash in plain mode with keyfile specified
Product:	Gentoo Linux	Reporter:	Toralf Förster <toralf>
Component:	Current packages	Assignee:	Gentoo's Team for Core System packages <base-system>
Status:	CONFIRMED ---
Severity:	trivial
Priority:	Low
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:
Package list:		Runtime testing required:	---

Description Toralf Förster gentoo-dev

2017-05-20 15:04:26 UTC

get this at a current hardened system in rc.log:


 * Setting up dm-crypt mappings ...
 *   crypt-swap using: -c aes -h sha1 -d /dev/urandom create crypt-swap /dev/sda2 ...
WARNING: The --hash parameter is being ignored in plain mode with keyfile specified.
 [ ok ]



with these settings :

# grep -v -e '#' -e '^$' /etc/conf.d/dmcrypt 
swap=crypt-swap
source='/dev/sda2'

Comment 1 Toralf Förster gentoo-dev

2017-09-13 13:04:38 UTC

From upstream (https://gitlab.com/cryptsetup/cryptsetup/issues/343#note_40201575O) :

"The warning is needed - the keyfile is in plain mode used directly (without hashing) for backward compatible reasons."

I do wonder if the default are fine here in Gentoo -or- if they should change ?