online
  "   €l–дY>”*C]Љm@=p,ЬTЕЈБѓyрАї "Е    Cryptsetup 2.1.0 Release Notes
==============================
Stable release with new features and bug fixes.

Cryptsetup 2.1 version uses a new on-disk LUKS2 format as the default
LUKS format and increases default LUKS2 header size.

The legacy LUKS (referenced as LUKS1) will be fully supported forever
as well as a traditional and fully backward compatible format.

When upgrading a stable distribution, please use configure option
--with-default-luks-format=LUKS1 to maintain backward compatibility.

This release also switches to OpenSSL as a default cryptographic
backend for LUKS header processing. Use --with-crypto_backend=gcrypt
configure option if you need to preserve legacy libgcrypt backend.

Please do not use LUKS2 without properly configured backup or
in production systems that need to be compatible with older systems.

Changes since version 2.0.6
~~~~~~~~~~~~~~~~~~~~~~~~~~~

* The default for cryptsetup LUKS format action is now LUKS2.
  You can use LUKS1 with cryptsetup option --type luks1.

* The default size of the LUKS2 header is increased to 16 MB.
  It includes metadata and the area used for binary keyslots;
  it means that LUKS header backup is now 16MB in size.

  Note, that used keyslot area is much smaller, but this increase
  of reserved space allows implementation of later extensions
  (like online reencryption).
  It is fully compatible with older cryptsetup 2.0.x versions.
  If you require to create LUKS2 header with the same size as
  in the 2.0.x version, use --offset 8192 option for luksFormat
  (units are in 512-bytes sectors; see notes below).

* Cryptsetup now doubles LUKS default key size if XTS mode is used
  (XTS mode uses two internal keys). This does not apply if key size
  is explicitly specified on the command line and it does not apply
  for the plain mode.
  This fixes a confusion with AES and 256bit key in XTS mode where
  code used AES128 and not AES256 as often expected.

  Also, the default keyslot encryption algorithm (if cannot be derived
  from data encryption algorithm) is now available as configure
  options --with-luks2-keyslot-cipher and --with-luks2-keyslot-keybits.
  The default is aes-xts-plain64 with 2 * 256-bits key.

* Default cryptographic backend used for LUKS header processing is now
  OpenSSL. For years, OpenSSL provided better performance for PBKDF.

  NOTE: Cryptsetup/libcryptsetup supports several cryptographic
  library backends. The fully supported are libgcrypt, OpenSSL and
  kernel crypto API. FIPS mode extensions are maintained only for
  libgcrypt and OpenSSL. Nettle and NSS are usable only for some
  subset of algorithms and cannot provide full backward compatibility.
  You can always switch to other backends by using a configure switch,
  for libgcrypt (compatibility for older distributions) use:
  --with-crypto_backend=gcrypt

* The Python bindings are no longer supported and the code was removed
  from cryptsetup distribution. Please use the libblockdev project
  that already covers most of the libcryptsetup functionality
  including LUKS2.

* Cryptsetup now allows using --offset option also for luksFormat.
  It means that the specified offset value is used for data offset.
  LUKS2 header areas are automatically adjusted according to this value.
  (Note units are in 512-byte sectors due to the previous definition
  of this option in plain mode.)
  This option can replace --align-payload with absolute alignment value.

* Cryptsetup now supports new refresh action (that is the alias for
  "open --refresh").
  It allows changes of parameters for an active device (like root
  device mapping), for example, it can enable or disable TRIM support
  on-the-fly.
  It is supported for LUKS1, LUKS2, plain and loop-AES devices.

* Integritysetup now supports mode with detached data device through
  new --data-device option.
  Since kernel 4.18 there is a possibility to specify external data
  device for dm-integrity that stores all integrity tags.

* Integritysetup now supports automatic integrity recalcul