get this at a current hardened system in rc.log:
* Setting up dm-crypt mappings ...
* crypt-swap using: -c aes -h sha1 -d /dev/urandom create crypt-swap /dev/sda2 ...
WARNING: The --hash parameter is being ignored in plain mode with keyfile specified.
[ ok ]
with these settings :
# grep -v -e '#' -e '^$' /etc/conf.d/dmcrypt
From upstream (https://gitlab.com/cryptsetup/cryptsetup/issues/343#note_40201575O) :
"The warning is needed - the keyfile is in plain mode used directly (without hashing) for backward compatible reasons."
I do wonder if the default are fine here in Gentoo -or- if they should change ?