Allow restrict keys size in LuksOpen (thanks to Stefan Assmann)

[platform/upstream/cryptsetup.git] / man / cryptsetup.8

diff --git a/man/cryptsetup.8 b/man/cryptsetup.8
index 9173e83..d76002b 100644 (file)
--- a/man/cryptsetup.8
+++ b/man/cryptsetup.8
@@ -84,7 +84,14 @@ For more information about LUKS, see \fBhttp://code.google.com/p/cryptsetup/wiki
 .SH OPTIONS
 .TP
 .B "\-\-hash, \-h"
-specifies hash to use for password hashing. This option is only relevant for \fIcreate\fR action. The hash string is passed to libgcrypt, so all hashes accepted by gcrypt are supported. Default is "ripemd160".
+For \fIcreate\fR action specifies hash to use for password hashing.
+
+For \fIluksFormat\fR action specifies hash used in LUKS key setup scheme and volume key digest.
+
+\fBWARNING:\fR setting hash other than \fBsha1\fR causes LUKS device incompatible with older version of cryptsetup.
+
+The hash string is passed to libgcrypt, so all hashes accepted by gcrypt are supported.
+Default is \fB"ripemd160"\fR for \fIcreate\fR action and \fB"sha1"\fR for \fIluksFormat\fR.
 .TP
 .B "\-\-cipher, \-c"
 set cipher specification string. For plain dm-crypt mappings, the default is "aes-cbc-plain", for LUKS mappings it's "aes-cbc-essiv:sha256". For pre-2.6.10 kernels, use "aes-plain" as they don't understand the new cipher spec strings. To use ESSIV, use "aes-cbc-essiv:sha256".
@@ -103,7 +110,9 @@ If the key file is "-", stdin will be used. This is different from how cryptsetu
 For LUKS operations that add key material, this options allows to you specify which key slot is selected for the new key. This option can be used for \fIluksFormat\fR and \fIluksAddKey\fR.
 .TP
 .B "\-\-key-size, \-s"
-set key size in bits. Has to be a multiple of 8 bits. The key size is limited by the used cipher. See output of /proc/crypto for more information. Can be used for \fIcreate\fR or \fIluksFormat\fR, all other LUKS actions will ignore this flag, as the key-size is specified by the partition header. Default is 128 for \fIluksFormat\fR and 256 for \fIcreate\fR.
+set key size in bits. Has to be a multiple of 8 bits. The key size is limited by the used cipher. See output of /proc/crypto for more information. Can be used for \fIcreate\fR or \fIluksFormat\fR, all other LUKS actions will use key-size specified by the LUKS header. Default is 128 for \fIluksFormat\fR and 256 for \fIcreate\fR.
+
+For \fIluksOpen\fR this option specifies number of bits read from the key-file (default is exhaustive read from key-file).
 .TP
 .B "\-\-size, \-b"
 force the size of the underlying device in sectors.
@@ -124,7 +133,7 @@ set up a read-only mapping.
 The number of milliseconds to spend with PBKDF2 password processing. This option is only relevant to the LUKS operations as \fIluksFormat\fR or \fIluksAddKey\fR.
 .TP
 .B "\-\-batch-mode, \-q"
-Do not ask for confirmation. This option is only relevant for \fIluksFormat\fR.
+Do not ask for confirmation. Use with care! This option is only relevant for \fIluksFormat\fR,\fIluksAddKey\fR,\fIluksRemoveKey\fR or \fIluksKillSlot\fR.
 .TP
 .B "\-\-timeout, \-t"
 The number of seconds to wait before timeout. This option is relevant every time a password is asked, like \fIcreate\fR, \fIluksOpen\fR, \fIluksFormat\fR or \fIluksAddKey\fR. It has no effect if used in conjunction with \-\-key-file.