Re: [gentoo-user] Kernel encryption options and veracrypt

[Dale]

Adam Carter wrote:
> On Thu, Mar 26, 2020 at 12:17 AM Dale  > wrote:
>
> Howdy,
>
> As some know from another thread, I installed and started using
> veracrypt.  It has the option to use the kernel encryption tools but
> they are not enabled on my kernel, just the default stuff.  I
> found what
> I think to be the ones veracrypt wants to use but was curious if I
> should enable some others that are commonly used. 
>
>
> I've wondered about what uses kernel crypto stuff too.
>
> I assumed userspace stuff would use openssl or similar, but looking at
> the ebuild for veracrypt, it doesnt use openssl etc but does want
> CONFIG_CRYPTO from the kernel so I guess it just depends on how the
> software is written.
>
> From the veracrypt-1.24_p4.ebuild;
> local CONFIG_CHECK="~BLK_DEV_DM ~CRYPTO ~CRYPTO_XTS ~DM_CRYPT ~FUSE_FS"
>
> But if we look at iwd-1.5.ebuild there's logic like;
>         if use cpu_flags_x86_ssse3 && use amd64; then
>                 CONFIG_CHECK="${CONFIG_CHECK} ~CRYPTO_SHA1_SSSE3
> ~CRYPTO_SHA256_SSSE3 ~CRYPTO_SHA512_SSSE3"
>                 WARNING_CRYPTO_SHA1_SSSE3="CRYPTO_SHA1_SSSE3: enable
> for increased performance"
>                 WARNING_CRYPTO_SHA256_SSSE3="CRYPTO_SHA256_SSSE3:
> enable for increased performance"
>                 WARNING_CRYPTO_SHA512_SSSE3="CRYPTO_SHA512_SSSE3:
> enable for increased performance"
>
> So if you assume the veracrypt ebuild authors are as diligent as the
> iwd ebuild authors, i'd say there's no advantage in enabling anything
> more than ~BLK_DEV_DM ~CRYPTO ~CRYPTO_XTS ~DM_CRYPT ~FUSE_FS for
> veracrypt.
>
>

I ended up googling and finding what several encryption programs use for
encryption and enabling all of them.  It was quite a few but if I decide
later to encrypt my /home, I think I have all that enabled plus what
veracrypt needs as well.  I haven't rebooted yet tho.  It's on my todo
list.  I'll get to see then if I got everything or not.  If not, I'll
rinse and repeat. 

Thanks for the info.

Dale

:-)  :-)

Re: [gentoo-user] Kernel encryption options and veracrypt

[Adam Carter]

On Thu, Mar 26, 2020 at 12:17 AM Dale  wrote:

> Howdy,
>
> As some know from another thread, I installed and started using
> veracrypt.  It has the option to use the kernel encryption tools but
> they are not enabled on my kernel, just the default stuff.  I found what
> I think to be the ones veracrypt wants to use but was curious if I
> should enable some others that are commonly used.
>

I've wondered about what uses kernel crypto stuff too.

I assumed userspace stuff would use openssl or similar, but looking at the
ebuild for veracrypt, it doesnt use openssl etc but does want CONFIG_CRYPTO
from the kernel so I guess it just depends on how the software is written.

>From the veracrypt-1.24_p4.ebuild;
local CONFIG_CHECK="~BLK_DEV_DM ~CRYPTO ~CRYPTO_XTS ~DM_CRYPT ~FUSE_FS"

But if we look at iwd-1.5.ebuild there's logic like;
if use cpu_flags_x86_ssse3 && use amd64; then
CONFIG_CHECK="${CONFIG_CHECK} ~CRYPTO_SHA1_SSSE3
~CRYPTO_SHA256_SSSE3 ~CRYPTO_SHA512_SSSE3"
WARNING_CRYPTO_SHA1_SSSE3="CRYPTO_SHA1_SSSE3: enable for
increased performance"
WARNING_CRYPTO_SHA256_SSSE3="CRYPTO_SHA256_SSSE3: enable
for increased performance"
WARNING_CRYPTO_SHA512_SSSE3="CRYPTO_SHA512_SSSE3: enable
for increased performance"

So if you assume the veracrypt ebuild authors are as diligent as the iwd
ebuild authors, i'd say there's no advantage in enabling anything more than
~BLK_DEV_DM ~CRYPTO ~CRYPTO_XTS ~DM_CRYPT ~FUSE_FS for veracrypt.