On Tue, Aug 30, 2022, at 9:43 AM, Chris Murphy wrote: > On Tue, Aug 30, 2022, at 8:27 AM, Richard W.M. Jones wrote: >> Another is that LUKS filesystem decryption uses a deliberately >> "memory-hard" algorithm called Argon2 which requires loads of RAM and >> sometimes has problems running on a machine with 1GB and no swap. > > The built-in default for cryptsetup on Fedora is LUKS2 which uses > argon2id with parameters: > Iteration time: 2000, Memory required: 1048576kB, Parallel threads: 4 > > It is possible to specify a different memory requirement at luksFormat > time. But I'm not sure if there's any warning emitted by cryptsetup if > there's significant memory pressure, i.e. high potential that a future > Fedora might fail to open this volume.
But yeah, if we have use cases where an encrypted image is created on a system or in a container with plenty of memory, thus the high memory requirement of the default applies, but then is later used with libguestfs in a container or VM with less memory available, it's a possible problem. I'm not really sure what the resolution for this is though. We'd either have to change the cryptsetup default to something like 512MB Fedora wide, or the burden is on the create time sysadmin to override the Fedora default. -- Chris Murphy _______________________________________________ devel mailing list -- devel@lists.fedoraproject.org To unsubscribe send an email to devel-le...@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
