v2.8.7From commit messages
Version 2.8.7.
Added 4
- Add keyring key type and load volume keys in intermediary keyring linked in thread keyring.
- Support Aria and Camellia ciphers in libgcrypt backend.
- Add storage wrappers option to use DMCRYPT wrapper only and add fallback to dmcrypt in LUKS21 keyslot processing.
- integritysetup: support --integrity-legacy-hmac in open.
Changed 3
- Remove logic for AF_ALG dependence in tcrypt and luks2, and do not print specific AF_ALG info in cryptsetup cipher benchmark.
- Switch LUKS2 reencryption and convert code to more capable LUKS_check_cipher check.
- Allow cached volume key in activation with CRYPT_KC_TYPE_KEY only and ensure CRYPT_VOLUME_KEY_NO_SEGMENT flag always creates unbound keyslot.
Fixed 3
- Fix tcrypt, luks2, and OpenSSL backend security issues including safe allocation for password pool, length overflow checks, buffer size validation, HMAC return value checks, PBKDF2 cast overflow, and json keyslot leak on error path.
- Fix reencryption name helper check and improve LUKS_check_cipher validation.
- Fix integrity shift overflow test and --tries option use.