"Fossies" - the Fresh Open Source Software Archive

Member "cryptsetup-2.4.3/docs/v2.3.6-ReleaseNotes" (13 Jan 2022, 2316 Bytes) of package /linux/misc/cryptsetup-2.4.3.tar.xz:

    1 Cryptsetup 2.3.6 Release Notes
    2 ==============================
    3 Stable bug-fix release with minor extensions.
    4 
    5 All users of cryptsetup 2.x and later should upgrade to this version.
    6 
    7 Changes since version 2.3.5
    8 ~~~~~~~~~~~~~~~~~~~~~~~~~~~
    9 
   10 * integritysetup: Fix possible dm-integrity mapping table truncation.
   11 
   12   While integritysetup in standalone mode (no encryption) was not
   13   designed to provide keyed (and cryptographically strong) data
   14   integrity protection, some options can use such algorithms (HMAC).
   15 
   16   If a key is used, it is directly sent to the kernel dm-integrity as
   17   a mapping table option (no key derivation is performed).
   18   For HMAC, such a key could be quite long (up to 4096 bytes in
   19   integritysetup CLI).
   20 
   21   Unfortunately, due to fixed buffers and not correctly checking string
   22   truncation, some parameter combinations could cause truncation
   23   of the dm-integrity mapping table.
   24   In most cases, the table was rejected by the kernel.
   25   The worst possible case was key truncation for HMAC options
   26   (internal_hash and journal_mac dm-integrity table options).
   27 
   28   This release fixes possible truncation and also adds more sanity
   29   checks to reject truncated options.
   30   Also, integritysetup now mentions maximal allowed key size
   31   in --help output.
   32 
   33   For old standalone dm-integrity devices where the key length was
   34   truncated, you have to modify (shorten) --integrity-key-size
   35   resp. --journal-integrity-key-size option now.
   36 
   37   This bug is _not_ present for dm-crypt/LUKS, LUKS2 (including
   38   integrity protection), or dm-verity devices; it affects only
   39   standalone dm-integrity with HMAC integrity protection.
   40 
   41 * cryptsetup: Backup header can be used to activate TCRYPT device.
   42   Use --header option to specify the header.
   43 
   44 * cryptsetup: Avoid LUKS2 decryption without detached header.
   45   This feature will be added later and is currently not supported.
   46 
   47 * Additional fixes and workarounds for common warnings produced
   48   by some static analysis tools (like gcc-11 analyzer) and additional
   49   code hardening.
   50 
   51 * Fix standalone libintl detection for compiled tests.
   52 
   53 * Add Blake2b and Blake2s hash support for crypto backends.
   54   Kernel and gcrypt crypto backend support all variants.
   55   OpenSSL supports only Blake2b-512 and Blake2s-256.
   56   Crypto backend supports kernel notation e.g. "blake2b-512".