100
  $   ˆl–äY>”*ClÊm@?pLÜÊbÑ¿Â„LºçÁÀ¿ 8(    Cryptsetup 2.8.0 Release Notes
==============================
Stable release with new features and bug fixes

All users of cryptsetup 2.7 must upgrade to this version.

Changes since version 2.7.5
~~~~~~~~~~~~~~~~~~~~~~~~~~~

* Introduce support for inline mode (use HW sectors with additional hardware metadata space).

  Some enterprise NVMe drives allow formatting sector size with additional metadata space,
  for example, sector size 4096 bytes + 64 bytes for metadata.
  We hope common firmware will soon support such features in more recent models.

  If this metadata space is available (not internally used by a data integrity profile),
  it removes the need to use the dm-integrity layer for sector metadata allocation.
  This means that the performance bottleneck caused by the dm-integrity journal is eliminated.

  Note: such drive must be reformatted with an external nvme tool.
  You can check for support (reported as LBA format) by running the command
    "nvme id-ns -H <nvme device>" and then you can reformat to the selected profile
  (with complete data loss) with "nvme format -l <lbaf>.
  This way, you can also reformat NVMe drive to 4096-byte sectors,which is strongly recommended
  for encryption performance.

  The required device mapper for inline mode was introduced in Linux kernel version 6.11.

  The inline mode can be used with the new --integrity-inline option.

  For integritysetup, the kernel dm-integrity layer is still used, but it directly maps metadata
  to the hardware (eliminating the journal).
  For cryptsetup, the dm-integrity layer is eliminated, and only the dm-crypt kernel driver is used.
  The libcryptsetup exports a new crypt_format_inline API call.

  Examples (underlying device must provide inline HW metadata space):

  Use integritysetup format with inline mode with default CRC32 checksums:

   # integritysetup format --sector-size 4096 --integrity-inline <device> [--no-wipe]
   # integritysetup open <device> test
   # integritysetup status test
     /dev/mapper/test is active.
       type:    INTEGRITY
       tag size: 4 [bytes]
       integrity: crc32c
       device: <device>
       sector size:  4096 [bytes]
       ...
       inline mode
       journal: not active

  Use LUKS2 with authenticated encryption (here with AEGIS AEAD cipher):

   # cryptsetup luksFormat --integrity-inline --integrity aead --sector-size 4096 \
                -c aegis128-random --key-size 128 <device> [--integrity-no-wipe]
   # cryptsetup open <device> test
   # cryptsetup luksDump <device>
     ...
     Requirements:   inline-hw-tags

  After format, the inline mode is used automatically, and no special options are needed.
  Please check the manual pages for more details about used options.

  Note that the LUKS2 authenticated encryption is still an experimental feature.
  The inline mode only improves performance by removing the dm-integrity layer.

* Finalize use of keyslot context API.

  Keyslot context is a generic abstraction over keyslot manipulation.
  It extends many exiting commands by additional functions like tokens in activation, resume,
  reencryption and similar commands without introducing new specific API functions.

* Make all keyslot context types fully self-contained.

  In the previous version, the caller is responsible for releasing of some allocated memory.
  In this version, all memory is allocated internally. The existing keyslot context API function
  provides backward compatibility through versioned symbols.

* Add --key-description and --new-key-description cryptsetup options.

  These can be used for the specification of the keyring with passphrase retrieval in the open,
  resize, luksResume, luksFormat, luksAddKey and luksDump.

* Support more precise keyslot selection in reencryption initialization.

  Reencryption must update stored keys in keyslots, so it needs to unlock all keyslots first.

  When no specific keyslot is selected by the --key-slot option, all active keyslots are updated.

  Users may narrow down the sele