Re: PSA for LUKS users

[Jonathan Brielmaier]

Am 20.04.23 um 06:03 schrieb Vagrant Cascadian:
> On 2023-04-19, Felix Lechner via wrote:
> > Given the broad popularity of LUKS full-disk encryption among our
> > fellow Guix users, I thought the community might appreciate reading
> > about potentially weak key-derivation functions in older LUKS
> > installations. [1]
> >
> > The article even offers fixes, although I cannot say whether your
> > system will boot after you follow the steps since I do not use LUKS
> > personally. Stay safe!
> ...
> > [1] https://mjg59.dreamwidth.org/66429.html
>
> In short, those instructions will almost certainly break Guix System!

Can confirm :) At least the described backup & restore procedure does work.

I also think, that our cryptsetup is quite old, so I built a patch for
updating: https://issues.guix.gnu.org/62960

> While recent grub2 finally has limited support for luks2, it only
> supports the weaker KDF (key derivation function) (PBKDF2?), as I
> understand it, though would be happy to be proven wrong!

The support seems pretty limited, as I only updated the LUKS version of
my root-partition to version 2 (still PBKDF) and it already refused to
boot...

~Jonathan