From 1e76cd6945a070ebf1d80ed82d094bd41aea8a7b Mon Sep 17 00:00:00 2001 From: Holger Wansing Date: Tue, 26 Aug 2014 19:05:25 +0000 Subject: loop-AES is no longer supported by the installer; update the manual accordingly. --- en/using-d-i/modules/partman-crypto.xml | 96 +++++---------------------------- 1 file changed, 12 insertions(+), 84 deletions(-) (limited to 'en/using-d-i') diff --git a/en/using-d-i/modules/partman-crypto.xml b/en/using-d-i/modules/partman-crypto.xml index ee8b6dff1..26e14b85d 100644 --- a/en/using-d-i/modules/partman-crypto.xml +++ b/en/using-d-i/modules/partman-crypto.xml @@ -50,21 +50,18 @@ include several cryptographic options for the partition. -&d-i; supports several encryption methods. The default method +The encryption method supported by &d-i; is dm-crypt (included in newer Linux kernels, -able to host LVM physical volumes), the other -is loop-AES (older, maintained separately from -the Linux kernel tree). Unless you have compelling reasons to do -otherwise, it is recommended to use the default. +able to host LVM physical volumes). -First, let's have a look at the options available when you select -Device-mapper (dm-crypt) as the encryption -method. As always: when in doubt, use the defaults, because +Let's have a look at the options available when you select +encryption via Device-mapper (dm-crypt). +As always: when in doubt, use the defaults, because they have been carefully chosen with security in mind. @@ -104,7 +101,7 @@ cipher. -IV algorithm: cbc-essiv:sha256 +IV algorithm: xts-plain64 @@ -119,7 +116,7 @@ data. From the provided alternatives, the default -cbc-essiv:sha256 is currently the least +xts-plain64 is currently the least vulnerable to known attacks. Use the other alternatives only when you need to ensure compatibility with some previously installed system that is not able to use newer algorithms. @@ -203,73 +200,8 @@ though. - - -If you select Encryption method: -Loopback (loop-AES) , the menu -changes to provide the following options: - - - - -Encryption: AES256 - - - -For loop-AES, unlike dm-crypt, the options for cipher and key size are -combined, so you can select both at the same time. Please see the -above sections on ciphers and key sizes for further information. - - - - - -Encryption key: Keyfile (GnuPG) - - - -Here you can select the type of the encryption key for this partition. - - - - Keyfile (GnuPG) - - -The encryption key will be generated from random data during the -installation. Moreover this key will be encrypted -with GnuPG, so to use it, you will need to -enter the proper passphrase (you will be asked to provide one later in -the process). - - - - - - Random key - - -Please see the section on random keys above. - - - - - - - - - -Erase data: yes - - - -Please see the section on erasing data above. - - - - - - - + + After you have selected the desired parameters for your encrypted partitions, return back to the main partitioning menu. There should @@ -321,16 +253,12 @@ This will be repeated for each partition to be encrypted. After returning to the main partitioning menu, you will see all encrypted volumes as additional partitions which can be configured in -the same way as ordinary partitions. The following example shows two -different volumes. The first one is encrypted via dm-crypt, the second -one via loop-AES. +the same way as ordinary partitions. The following example shows a +volume encrypted via dm-crypt. Encrypted volume (sda2_crypt) - 115.1 GB Linux device-mapper #1 115.1 GB F ext3 - -Loopback (loop0) - 515.2 MB AES256 keyfile - #1 515.2 MB F ext3 Now is the time to assign mount points to the volumes and optionally @@ -340,7 +268,7 @@ change the file system types if the defaults do not suit you. Pay attention to the identifiers in parentheses (sda2_crypt -and loop0 in this case) and the mount +in this case) and the mount points you assigned to each encrypted volume. You will need this information later when booting the new system. The differences between the ordinary boot process and the boot process with encryption involved will -- cgit v1.2.3