From 6504f7fe43e9264a110527374f4bbe20f8e0004d Mon Sep 17 00:00:00 2001 From: Daniel Baumann Date: Wed, 17 Apr 2024 10:04:28 +0200 Subject: Adding upstream version 2:2.6.1. Signed-off-by: Daniel Baumann --- docs/v1.6.5-ReleaseNotes | 54 ++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 54 insertions(+) create mode 100644 docs/v1.6.5-ReleaseNotes (limited to 'docs/v1.6.5-ReleaseNotes') diff --git a/docs/v1.6.5-ReleaseNotes b/docs/v1.6.5-ReleaseNotes new file mode 100644 index 0000000..0f46964 --- /dev/null +++ b/docs/v1.6.5-ReleaseNotes @@ -0,0 +1,54 @@ +Cryptsetup 1.6.5 Release Notes +============================== + +Changes since version 1.6.4 + +* Allow LUKS header operation handling without requiring root privilege. + It means that you can manipulate with keyslots as a regular user, only + write access to device (or image) is required. + + This requires kernel crypto wrapper (similar to TrueCrypt device handling) + to be available (CRYPTO_USER_API_SKCIPHER kernel option). + If this kernel interface is not available, code fallbacks to old temporary + keyslot device creation (where root privilege is required). + + Note that activation, deactivation, resize and suspend operations still + need root privilege (limitation of kernel device-mapper backend). + +* Fix internal PBKDF2 key derivation function implementation for alternative + crypto backends (kernel, NSS) which do not support PBKDF2 directly and have + issues with longer HMAC keys. + + This fixes the problem for long keyfiles where either calculation is too slow + (because of internal rehashing in every iteration) or there is a limit + (kernel backend seems to not support HMAC key longer than 20480 bytes). + + (Note that for recent version of gcrypt, nettle or openssl the internal + PBKDF2 code is not compiled in and crypto library internal functions are + used instead.) + +* Support for Python3 for simple Python binding. + Python >= 2.6 is now required. You can set Python compiled version by setting + --with-python_version configure option (together with --enable-python). + +* Use internal PBKDF2 in Nettle library for Nettle crypto backend. + Cryptsetup compilation requires Nettle >= 2.6 (if using Nettle crypto backend). + +* Allow simple status of crypt device without providing metadata header. + The command "cryptsetup status" will print basic info, even if you + do not provide detached header argument. + +* Allow one to specify ECB mode in cryptsetup benchmark. + +* Add some LUKS images for regression testing. + Note that if image with Whirlpool fails, the most probable cause is that + you have old gcrypt library with flawed whirlpool hash. + Read FAQ section 8.3 for more info. + +Cryptsetup API NOTE: +The direct terminal handling for passphrase entry will be removed from +libcryptsetup in next major version (application should handle it itself). + +It means that you have to always either provide password in buffer or set +your own password callback function trhough crypt_set_password_callback(). +See API documentation (or libcryptsetup.h) for more info. -- cgit v1.2.3