File Content: v1.1.0-ReleaseNotes Cryptsetup 1.1.0 Release Notes ============================== Changes since version 1.0.7 ---------------------------- Important changes: ~~~~~~~~~~~~~~~~~~ * IMPORTANT: the default compiled-in cipher parameters changed plain mode: aes-cbc-essiv:sha256 (default is backward incompatible!). LUKS mode: aes-cbc-essiv:sha256 (only key size increased) In both modes is now default key size 256bits. * Default compiled-in parameters are now configurable through configure options: --with-plain-* / --with-luks1-* (see configure --help) * If you need backward compatible defaults for distribution use configure --with-plain-mode=cbc-plain --with-luks1-keybits=128 Default compiled-in modes are printed in "cryptsetup --help" output. * Change in iterations count (LUKS): The slot and key digest iteration minimum count is now 1000. The key digest iteration count is calculated from iteration time (approx 1/8 of req. time). For more info about above items see discussion here: http://tinyurl.com/yaug97y * New libcryptsetup API (documented in libcryptsetup.h). The old API (using crypt_options struct) is still available but will remain frozen and not used for new functions. Soname of library changed to libcryptsetup.so.1.0.0. (But only recompilation should be needed for old programs.) The new API provides much more flexible operation over LUKS device for applications, it is preferred that new applications will use libcryptsetup and not wrapper around cryptsetup binary. * New luksHeaderBackup and luksHeaderRestore commands. These commands allows binary backup of LUKS header. Please read man page about possible security issues with backup files. * New luksSuspend (freeze device and wipe key) and luksResume (with provided passphrase). luksSuspend wipe encryption key in kernel memory and set device to suspend (blocking all IO) state. This option can be used for situations when you need temporary wipe encryption key (like suspend to RAM etc.) Please read man page for more information. * New --master-key-file option for luksFormat and luksAddKey. User can now specify pre-generated master key in file, which allows regenerating LUKS header or add key with only master key knowledge. * Uses libgcrypt and enables all gcrypt hash algorithms for LUKS through -h luksFormat option. Please note that using different hash for LUKS header make device incompatible with old cryptsetup releases. * Introduces --debug parameter. Use when reporting bugs (just run cryptsetup with --debug and attach output to issue report.) Sensitive data are never printed to this log. * Moves command successful messages to verbose level. * Requires device-mapper library and libgcrypt to build. * Uses dm-uuid for all crypt devices, contains device type and name now. * Removes support for dangerous non-exclusive option (it is ignored now, LUKS device must be always opened exclusive) Other changes: ~~~~~~~~~~~~~~ * Fixed localization to work again. Also cryptsetup is now translated by translationproject.org. * Fix some libcryptsetup problems, including * exported symbols and versions in libcryptsetup (properly use versioned symbols) * Add crypt_log library function. * Add CRYPT_ prefix to enum defined in libcryptsetup.h. * Move duplicate Command failed message to verbose level (error is printed always). * Fix several problems in build system * use autopoint and clean gettext processing. * Check in configure if selinux libraries are required in static version. * Fix build for non-standard location of gcrypt library. * Add temporary debug code to find processes locking internal device. * Fix error handling during reading passphrase. * Fail passphrase read if piped input no longer exists. * Fix man page to not require --size which expands to device size by default. * Clean up Makefiles and configure script. * Try to read first sector from device to properly check that device is ready. * Move memory locking and dm initialization to command layer. * Increase priority of process if memory is locked. * Add log macros and make logging more consistent. * Keyfile now must be provided by path, only stdin file descriptor is used (api only). * Do not call isatty() on closed keyfile descriptor. * Move key slot manipulation function into LUKS specific code. * Replace global options struct with separate parameters in helper functions. * Implement old API calls using new functions. * Allow using passphrase provided in options struct for LuksOpen. * Allow restrict keys size in LuksOpen. * Fix errors when compiled with LUKS_DEBUG. * Print error when getline fails. * Completely remove internal SHA1 implementation code, not needed anymore. * Pad luks header to 512 sector size. * Rework read/write blockwise to not split operation to many pieces. * Use posix_memalign if available. * Fix segfault if provided slot in luksKillslot is invalid. * Remove unneeded timeout when remove of temporary device succeeded. Submit