{"id":113107,"date":"2024-01-24T23:28:03","date_gmt":"2024-01-24T21:28:03","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vypusk-cryptsetup-2-7-s-podderzhkoj-apparatnogo-diskovogo-shifrovaniya-opal"},"modified":"2024-01-24T23:28:03","modified_gmt":"2024-01-24T21:28:03","slug":"vypusk-cryptsetup-2-7-s-podderzhkoj-apparatnogo-diskovogo-shifrovaniya-opal","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/vypusk-cryptsetup-2-7-s-podderzhkoj-apparatnogo-diskovogo-shifrovaniya-opal","title":{"rendered":"Release of Cryptsetup 2.7 with support for OPAL hardware disk encryption","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
A set of Cryptsetup 2.7 utilities has been released, intended for configuring disk partition encryption in Linux using the dm-crypt module. It supports working with dm-crypt partitions, LUKS, LUKS2, BITLK, loop-AES, and TrueCrypt\/VeraCrypt. It also includes utilities veritysetup and integritysetup for configuring data integrity verification tools based on the dm-verity and dm-integrity modules. <\/p>\n
Key Improvements: <\/p>\n
\n
It is now possible to utilize the hardware-based encryption mechanism of OPAL, supported on self-encrypting drives (SED) \u2014 SATA and NVMe storage devices with OPAL2 TCG interface, where the hardware encryption device is built directly into the controller. On one hand, OPAL encryption is tied to proprietary hardware and is not available for public audit; on the other hand, it can be used as an additional layer of protection over software encryption without reducing performance and without creating load on the CPU.\n
To use OPAL in LUKS2, a Linux kernel build with the CONFIG_BLK_SED_OPAL option and enabling in Cryptsetup (by default, OPAL support is disabled) is required. Configuration of LUKS2 OPAL is performed similarly to software encryption \u2014 metadata is saved in the LUKS2 header. The key is divided into a partition key for software encryption (dm-crypt) and an unlock key for OPAL. OPAL can be used both in conjunction with software encryption (cryptsetup luksFormat \u2014hw-opal ) and separately (cryptsetup luksFormat \u2014hw-opal-only ). Activation and deactivation of OPAL is carried out in the same way (open, close, luksSuspend, luksResume) as for LUKS2 devices. <\/p>\n
In plain mode, where the master key and header are not stored on disk, the aes-xts-plain64 cipher and sha256 hashing algorithm are used by default (instead of CBC mode, which has performance issues, XTS is used, and instead of the outdated ripemd160 hash \u2014 sha256).\n
In the open and luksResume commands, storing the partition key in the user-selected key storage in the kernel (keyring) is permitted. To access the keyring, many cryptsetup commands have been added with the option '\u2014volume-key-keyring' (for example, 'cryptsetup open \u2014link-vk-to-keyring '@s::%user:testkey' tst').\n
On systems without a swap partition, when formatting or creating a key slot for PBKDF Argon2, only half of the free memory is now used, which resolved the issue of running out of available memory on systems with limited RAM.\n
An option '\u2014external-tokens-path' has been added to specify the directory for external LUKS2 token handlers (plugins).\n
Support for the Blake2 hashing algorithm has been added to tcrypt for VeraCrypt.\n
Support for the Aria block cipher has been added.\n
Support for Argon2 in implementations of OpenSSL 3.2 and libgcrypt has been added, allowing for operation without using libargon. <\/ul>\n