From 869feacb6b4a22c169f2f505151cbb2a9c86bbd7 Mon Sep 17 00:00:00 2001 From: Petr Bokoc Date: Apr 29 2019 15:08:44 +0000 Subject: 282 - cryptsetup defaults to luks2 --- diff --git a/modules/release-notes/pages/sysadmin/Security.adoc b/modules/release-notes/pages/sysadmin/Security.adoc index 6d51224..cb3318f 100644 --- a/modules/release-notes/pages/sysadmin/Security.adoc +++ b/modules/release-notes/pages/sysadmin/Security.adoc @@ -8,3 +8,12 @@ include::{partialsdir}/entities.adoc[] Starting with Fedora 30, the `/usr/bin/gpg` path representing the main GPG implementation uses GnuPG 2 instead of version 1 used in earlier releases. This change brings Fedora in line with other major distributions, and provides users with consistent experience between distributions. + +== Cryptsetup metadata format changed to LUKS2 + +The default metadata encryption format for full disk encryption has been changed from LUKS1 to LUKS2. +LUKS2 is an evolution of the standard that enables new features such as the Argon2 kdf for keyslots (alongside currently used PBKDF2), improved support for automatic activation, support for wrapped key ciphers (the `paes` cipher), and experimental authenticated encryption. + +LUKS1 continues to be supported. + +Note that older boot media (Fedora 27 and earlier) do not provide a version of cryptsetup that can unlock LUKS2-encrypted volumes. This means a Fedora 27 or earlier installation ISO can not be used to rescue a system with LUKS2 encryption.