44ca5f7379Accepting request 1229756 from security
factory
Ana Guerrero
2024-12-11 20:00:52 +0000
885a1330e4- cryptsetup-fips140-3.patch: extend the password for PBKDF2 benchmarking to be more than 20 chars to meet FIPS 140-3 requirements (bsc#1229975)
devel
Pedro Monreal Gonzalez2024-12-03 09:35:06 +0000
0c48009205Accepting request 1200765 from security
Ana Guerrero
2024-09-15 10:32:53 +0000
e7976f0568- Update to 2.7.5: * Fix possible online reencryption data corruption (only in 2.7.x). In some situations (initializing a suspended device-mapper device), cryptsetup disabled direct-io device access. This caused unsafe online reencryption operations that could lead to data corruption. The code now adds strict checks (and aborts the operation) and changes direct-io detection code to prevent data corruption. * Fix a clang compilation error in SSH token plugin. As clang linker treats missing symbols as errors, the linker phase for the SSH token failed as the optional cryptsetup_token_buffer_free was not defined. * Fix crypto backend initialization in crypt_format_luks2_opal API call.Pedro Monreal Gonzalez2024-09-13 07:39:51 +0000
60962f2300Accepting request 1064730 from security
Dominique Leuenberger
2023-02-14 15:42:30 +0000
43e9b52bc7Accepting request 1064729 from home:AndreasStieger:branches:securityAndreas Stieger2023-02-12 21:21:51 +0000
2e667013fcAccepting request 1055943 from security
Dominique Leuenberger
2023-01-05 14:00:19 +0000
cf385930c9Accepting request 1052843 from home:lnussel:usrmergeAndreas Stieger2023-01-04 16:08:29 +0000
e9929646b3Accepting request 1038821 from security
Dominique Leuenberger
2022-11-30 13:58:56 +0000
8cea81ce7bAccepting request 1038690 from home:polslinux:branches:securityLudwig Nussel2022-11-29 07:29:17 +0000
db4246dcb6Accepting request 1003455 from security
Dominique Leuenberger
2022-09-15 20:57:41 +0000
59aec6d066Accepting request 1003354 from home:bluca:branches:securityLudwig Nussel2022-09-14 07:18:13 +0000
c067b49ecaAccepting request 999047 from security
Dominique Leuenberger
2022-08-25 13:33:10 +0000
0ffce94442Accepting request 999046 from home:lnussel:branches:securityLudwig Nussel2022-08-24 11:32:11 +0000
de1f20aa9dAccepting request 946915 from security
Dominique Leuenberger
2022-01-19 23:11:59 +0000
ee04894715Accepting request 946498 from home:AndreasStieger:branches:securityLudwig Nussel2022-01-17 09:00:02 +0000
3ec70ab5a7Accepting request 919547 from security
Dominique Leuenberger
2021-09-21 19:12:23 +0000
1e4cc6eca2- cryptsetup 2.4.1 * Fix compilation for libc implementations without dlvsym(). * Fix compilation and tests on systems with non-standard libraries * Try to workaround some issues on systems without udev support. * Fixes for OpenSSL3 crypto backend (including FIPS mode). * Print error message when assigning a token to an inactive keyslot. * Fix offset bug in LUKS2 encryption code if --offset option was used. * Do not allow LUKS2 decryption for devices with data offset. * Fix LUKS1 cryptsetup repair command for some specific problems. - cryptsetup 2.4.0 (jsc#SLE-20275)Ludwig Nussel2021-09-16 15:25:13 +0000
a9f0d82fe4Accepting request 915495 from security
Dominique Leuenberger
2021-09-02 21:20:08 +0000
cddcbab746- As YaST passes necessary parameters to cryptsetup anyway, we do not necessarily need to take grub into consideration. So back to Argon2 to see how it goes.Ludwig Nussel2021-08-25 13:47:31 +0000
8873d8f729- New version to 2.3.1 * Support VeraCrypt 128 bytes passwords. VeraCrypt now allows passwords of maximal length 128 bytes (compared to legacy TrueCrypt where it was limited by 64 bytes). * Strip extra newline from BitLocker recovery keys There might be a trailing newline added by the text editor when the recovery passphrase was passed using the --key-file option. * Detect separate libiconv library. It should fix compilation issues on distributions with iconv implemented in a separate library. * Various fixes and workarounds to build on old Linux distributions. * Split lines with hexadecimal digest printing for large key-sizes. * Do not wipe the device with no integrity profile. With --integrity none we performed useless full device wipe. * Workaround for dm-integrity kernel table bug. Some kernels show an invalid dm-integrity mapping table if superblock contains the "recalculate" bit. This causes integritysetup to not recognize the dm-integrity device. Integritysetup now specifies kernel options such a way that even on unpatched kernels mapping table is correct. * Print error message if LUKS1 keyslot cannot be processed. If the crypto backend is missing support for hash algorithms used in PBKDF2, the error message was not visible. * Properly align LUKS2 keyslots area on conversion. If the LUKS1 payload offset (data offset) is not aligned to 4 KiB boundary, new LUKS2 keyslots area in now aligned properly. * Validate LUKS2 earlier on conversion to not corrupt the device if binary keyslots areas metadata are not correct.Ludwig Nussel2020-04-02 14:27:54 +0000
7252bcb7bdAccepting request 770054 from security
Dominique Leuenberger
2020-02-09 20:02:18 +0000
c833c93fcfAccepting request 769866 from home:polslinux:branches:securityLudwig Nussel2020-02-04 16:53:39 +0000
f33f765a5eAccepting request 755886 from security
Dominique Leuenberger
2019-12-17 12:29:09 +0000
6a28f3c770Accepting request 739355 from home:vitezslav_cizek:branches:securityLudwig Nussel2019-12-11 15:11:37 +0000
1590108120Accepting request 701789 from security
Dominique Leuenberger
2019-05-14 11:29:48 +0000
277dfb964cAccepting request 677121 from security
Yuchen Lin
2019-02-20 13:08:36 +0000
b860f84eddAccepting request 676570 from home:jengelh:branches:securityLudwig Nussel2019-02-18 12:27:45 +0000
901c97104c- New version 2.1.0 * The default size of the LUKS2 header is increased to 16 MB. It includes metadata and the area used for binary keyslots; it means that LUKS header backup is now 16MB in size. * Cryptsetup now doubles LUKS default key size if XTS mode is used (XTS mode uses two internal keys). This does not apply if key size is explicitly specified on the command line and it does not apply for the plain mode. This fixes a confusion with AES and 256bit key in XTS mode where code used AES128 and not AES256 as often expected. * Default cryptographic backend used for LUKS header processing is now OpenSSL. For years, OpenSSL provided better performance for PBKDF. * The Python bindings are no longer supported and the code was removed from cryptsetup distribution. Please use the libblockdev project that already covers most of the libcryptsetup functionality including LUKS2. * Cryptsetup now allows using --offset option also for luksFormat. * Cryptsetup now supports new refresh action (that is the alias for "open --refresh"). * Integritysetup now supports mode with detached data device through new --data-device option. - 2.1.0 would use LUKS2 as default, we stay with LUKS1 for now until someone has time to evaluate the fallout from switching to LUKS2.Ludwig Nussel2019-02-15 14:36:10 +0000
96adeab889Accepting request 645684 from security
Dominique Leuenberger
2018-11-06 14:25:37 +0000
3dd02a4dccAccepting request 645498 from home:lnussel:branches:securityLudwig Nussel2018-10-31 08:59:56 +0000
873a55aadcAccepting request 630730 from security
Dominique Leuenberger
2018-08-28 07:22:31 +0000
b9976bf5b8- New version 2.0.4 Changes since version 2.0.3 ~~~~~~~~~~~~~~~~~~~~~~~~~~~ * Use the libblkid (blockid) library to detect foreign signatures on a device before LUKS format and LUKS2 auto-recovery. This change fixes an unexpected recovery using the secondary LUKS2 header after a device was already overwritten with another format (filesystem or LVM physical volume). LUKS2 will not recreate a primary header if it detects a valid foreign signature. In this situation, a user must always use cryptsetup repair command for the recovery. Note that libcryptsetup and utilities are now linked to libblkid as a new dependence. To compile code without blockid support (strongly discouraged), use --disable-blkid configure switch. * Add prompt for format and repair actions in cryptsetup and integritysetup if foreign signatures are detected on the device through the blockid library. After the confirmation, all known signatures are then wiped as part of the format or repair procedure. * Print consistent verbose message about keyslot and token numbers. For keyslot actions: Key slot <number> unlocked/created/removed. For token actions: Token <number> created/removed. * Print error, if a non-existent token is tried to be removed. * Add support for LUKS2 token definition export and import. The token command now can export/import customized token JSON file directly from command line. See the man page for more details. * Add support for new dm-integrity superblock version 2. * Add an error message when nothing was read from a key file. * Update cryptsetup man pages, including --type option usage.Ludwig Nussel2018-08-21 07:44:40 +0000
7375ef6f52Accepting request 574742 from security
Dominique Leuenberger
2018-02-13 09:25:18 +0000
6a3a5ab46fAccepting request 574741 from home:AndreasStieger:branches:securityLudwig Nussel2018-02-09 15:48:12 +0000
d2aa865791Accepting request 562805 from security
Dominique Leuenberger
2018-01-31 18:48:16 +0000
Ana Guerrero
Pedro Monreal Gonzalez
Andreas Stieger
Dominique Leuenberger
Ludwig Nussel
Richard Brown
Yuchen Lin
Marcus Meissner
Alexander Naumov
Stephan Kulow