0 ;5lY>*C]m@=p,Tţ [ia=JJj"Tn/e1h-5Cryptsetup 2.5.0 Release Notes ============================== Stable release with new features and bug fixes. Changes since version 2.4.3 ~~~~~~~~~~~~~~~~~~~~~~~~~~~ * Split manual pages into per-action pages and use AsciiDoc format. Manual pages are now generated from AsciiDoc format, allowing easy conditional modifications for per-action options. Generation of man pages requires the asciidoctor tool installed. Pre-generated man pages are also included in the distribution tarball. You can use --disable-asciidoc configure option to skip man page generation completely. In this case, pre-generated man pages will be used for installation. For cryptsetup, there is main man page (cryptsetup.8) that references separate man pages for each command (for example, cryptsetup-open.8). You can open such a man page by simply running "man cryptsetup open". Also, man pages for action aliases are available (cryptsetup-luksOpen.8 is an alias for cryptsetup-open.8, etc.) LUKS volume reencryption changes ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ * Remove cryptsetup-reencrypt tool from the project and move reencryption to already existing "cryptsetup reencrypt" command. Cryptsetup reencrypt now handles both LUKS1 and LUKS2 reencryption, encryption, and decryption. If you need to emulate the old cryptsetup-reencrypt binary, use simple wrappers script running "exec cryptsetup reencrypt $@". All command line options should be compatible. An exception is the reencryption of LUKS2 volumes with old LUKS1 reencryption code that was replaced by native and more resilient LUKS2 reencryption. * LUKS2: implement --decryption option that allows LUKS removal. The operation can run online or offline and supports the data shift option. During the initialization, the LUKS2 header is exported to a file. The first data segment is moved to the head of the data device in place of the original header. The feature internally introduces several new resilience modes (combination of existing modes datashift and "checksum" or "journal"). Datashift resilience mode is applied for data moved towards the first segment, and the first segment is then decrypted in place. This decryption mode is not backward compatible with prior LUKS2 reencryption. Interrupted operations in progress cannot be resumed using older cryptsetup releases. * Reencryption metadata options that are not compatible with recent code (features implemented in more recent releases) are now only read, but code will not activate or modify such metadata. Reencryption metadata contains a version that is validated when reencryption is resumed. For more info, see the updated LUKS2 on-disk format specification. Safe operation of reencryption is to always finish the operation with only one version of the tools. * Fix decryption operation with --active-name option and restrict it to be used only with LUKS2. * Do not refresh reencryption digest when not needed. This should speed up the reencryption resume process. * Store proper resilience data in LUKS2 reencrypt initialization. Resuming reencryption now does not require specification of resilience type parameters if these are the same as during initialization. * Properly wipe the unused area after reencryption with datashift in the forward direction. * Check datashift value against larger sector size. For example, it could cause an issue if misaligned 4K sector appears during decryption. * Do not allow sector size increase reencryption in offline mode. The eventual logical block size increase on the dm-crypt device above may lead to an unusable filesystem. Do not allow offline reencryption when sector size increase is requested. You can use --force-offline-reencrypt option to override this check (and potentially destroy the data). * Do not allow dangerous sector size change during reencryption. By changing the encryption sector size during reencryption, a user may incre