4:33 " la*j"Tnq)F h auto # lY>*C]m@=p,Tţ ? Cryptsetup 2.7.0 Release Notes ============================== Stable release with new features and bug fixes. Changes since version 2.6.1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~ * Introduce support for hardware OPAL disk encryption. Some SATA and NVMe devices support hardware encryption through OPAL2 TCG interface (SEDs - self-encrypting drives). Using hardware disk encryption is controversial as you must trust proprietary hardware. On the other side, using both software and hardware encryption layers increases the security margin by adding an additional layer of protection. There is usually no performance drop if OPAL encryption is used (the drive always operates with full throughput), and it does not add any utilization to the main CPU. LUKS2 now supports hardware encryption through the Linux kernel SED OPAL interface (CONFIG_BLK_SED_OPAL Linux kernel option must be enabled). Cryptsetup OPAL is never enabled by default; you have to use luksFormat parameters to use it. OPAL support can be disabled during the build phase with --disable-hw-opal configure option. LUKS2 OPAL encryption is configured the same way as software encryption - it stores metadata in the LUKS2 header and activates encryption for the data area on the disk (configured OPAL locking range). LUKS2 header metadata must always be visible (thus not encrypted). The key stored in LUKS2 keyslots contains two parts - volume key for software (dm-crypt) encryption and unlocking key for OPAL. OPAL unlocking key is independent of the dm-crypt volume key and is always 256 bits long. Cryptsetup does not support full drive OPAL encryption; only a specific locking range is always used. If the OPAL device is in its initial factory state (after factory reset), cryptsetup needs to configure the OPAL admin user and password. If the OPAL admin user is already set, the OPAL password must be provided during luksFormat. The provided password is needed only to configure or reset the OPAL locking range; LUKS device activation requires LUKS passphrase only. LUKS passphrase should be different from OPAL password (OPAL admin user is configured inside OPAL hardware while LUKS unlocking passphrase unlocks LUKS keyslot). OPAL encryption can be used in combination with software (dm-crypt) encryption (--hw-opal option) or without the software layer (--hw-opal-only option). You can see the configured segment parameters in the luksDump command. LUKS2 devices with OPAL segments set a new requirement flag in the LUKS2 header to prevent older cryptsetup metadata manipulation. Do not use hardware-only encryption if you do not fully trust your hardware vendor. Compatibility notes: - Linux kernel SED interface does NOT work through USB external adapters due to the missing compatibility layer in Linux USB storage drivers (even if USB hardware itself can support OPAL commands). - other TCG security subsystems like Ruby or Pyrite are not supported. Note that many drives support only Pyrite subsystem that does NOT encrypt data (it provides only authentication). - compatibility among OPAL-enabled drives is often very problematic, specifically for older drives. Many drives have bugs in the firmware that make the Linux kernel interface unusable. - if you forget the OPAL admin password, the only way to recover is the full drive factory reset through the PSID key (usually printed on the drive itself) that wipes all data on the drive (not only the LUKS area). - cryptsetup reencryption is not supported for LUKS2 OPAL-enabled devices - most OPAL drives use AES-XTS cipher mode (older drives can use AES-CBC). This information is not available through kernel SED API. - locked OPAL locking ranges return IO errors while reading; this can produce a lot of scary messages in the log if some tools (like blkid) try to read the locked area. Exampl