Arch Linux mit vollständiger Festplattenverschlüsselung
GRUB Bootloader zusammen mit LUKS2 und BTRFS Dateisystem Die Einrichtung von Arch Linux mit vollständiger Festplattenverschlüsselung durch LUKS2 bietet ein hohes Maß an Sicherheit für Benutzerdaten und Systemintegrität. LUKS2 (Linux […]
#arch #btrfs #grub #installation #linux #luks #luks2 #verschlüsselung
https://dirkwouters.de/arch-linux-mit-vollstaendiger-festplattenverschluesselung/
Pag. 2 di 3
Scelte adottate per il #distacco dalle #bigtech cercando di mantenere l'obiettivo della #sovranitàdigitale e rimanendo nel #europeancontest:
- Client Posta: #thunderbird
- #crittografia dischi: #luks e #luks2
- Suite Office: @ONLYOFFICE
- backup: #freefilesync (sto cercando alternativa conforme ai miei obiettivi)
- Sistema Operativo: @manjarolinux
- dischi esterni: #segateradrive 4T e 5T
- caldav e cardav sync: @davx5app
Achievement unlocked: used systemd-cryptenroll with a newly-installed TPM2 device in my home server to automatically unlock a LUKS2 container (which contains a ZFS pool). I still need to enable Secure Boot on this machine, but this is progress.
New: Encryption with LUKS2 when installing from ISO image
Read more: https://www.tuxedocomputers.com/en/New-ISO-Image-for-TUXEDO-OS-with-encryption.tuxedo
Linux Weekly Roundup: EndeavourOS Galileo with KDE, Rocky Linux 9.3 Updates, Proxmox VE 8.1 Enhancements, and More!
#EndeavourOS #RockyLinux #Proxmox #FreeBSD #OpenMandriva #KDE #LUKS2 #Calamares #SecureBoot #CephReef #OpenSSH #Plasma
https://linuxtldr.com/weekly-roundup/
#Tails 5.14 Ships with Automatic Migration to #LUKS2 
https://linuxiac.com/tails-5-14-ships-with-automatic-migration-to-luks2/
As you mentioned reencrypt, that's about encrypting existing data? Then maybe this #RHEL guide helps:
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/security_hardening/encrypting-block-devices-using-luks_security-hardening#encrypting-existing-data-on-a-block-device-using-luks2_encrypting-block-devices-using-luks
Or just have a complete backup (you should anyway), wipe, create a #LUKS2 partition and possibly #LVM on it and restore..
Thank you for sounding the alert!
I identified a minor issue with your otherwise nice explanation: According to my sources (man cryptsetup, #rfc9106), all #argon2 varieties are memory-hard. RFC 9106 is even titled “Argon2 Memory-Hard Function for Password Hashing and Proof-of-Work Applications”.
However, given that there are known attacks against #argon2i, it seems wise to use #argon2id instead. It is also what is recommended in the RFC.
As a #QubesOS user, I just checked the state of affairs there:
The cryptsetup that comes with QubesOS 3.x used #luks1, and those who did an in-place upgrade to 4.x still have that unless they converted to #luks2 manually (as detailed in the migration guide).
The cryptsetup in QubesOS 4.x uses #luks2, but it still defaults to #argon2i unfortunately.
