Re: [gentoo-user] Kernel encryption options and veracrypt

[Dale]

Adam Carter wrote:
> On Thu, Mar 26, 2020 at 12:17 AM Dale <rdalek1967@×××××.com
> <mailto:rdalek1967@×××××.com>> wrote:
>
>     Howdy,
>
>     As some know from another thread, I installed and started using
>     veracrypt.  It has the option to use the kernel encryption tools but
>     they are not enabled on my kernel, just the default stuff.  I
>     found what
>     I think to be the ones veracrypt wants to use but was curious if I
>     should enable some others that are commonly used. 
>
>
> I've wondered about what uses kernel crypto stuff too.
>
> I assumed userspace stuff would use openssl or similar, but looking at
> the ebuild for veracrypt, it doesnt use openssl etc but does want
> CONFIG_CRYPTO from the kernel so I guess it just depends on how the
> software is written.
>
> From the veracrypt-1.24_p4.ebuild;
> local CONFIG_CHECK="~BLK_DEV_DM ~CRYPTO ~CRYPTO_XTS ~DM_CRYPT ~FUSE_FS"
>
> But if we look at iwd-1.5.ebuild there's logic like;
>         if use cpu_flags_x86_ssse3 && use amd64; then
>                 CONFIG_CHECK="${CONFIG_CHECK} ~CRYPTO_SHA1_SSSE3
> ~CRYPTO_SHA256_SSSE3 ~CRYPTO_SHA512_SSSE3"
>                 WARNING_CRYPTO_SHA1_SSSE3="CRYPTO_SHA1_SSSE3: enable
> for increased performance"
>                 WARNING_CRYPTO_SHA256_SSSE3="CRYPTO_SHA256_SSSE3:
> enable for increased performance"
>                 WARNING_CRYPTO_SHA512_SSSE3="CRYPTO_SHA512_SSSE3:
> enable for increased performance"
>
> So if you assume the veracrypt ebuild authors are as diligent as the
> iwd ebuild authors, i'd say there's no advantage in enabling anything
> more than ~BLK_DEV_DM ~CRYPTO ~CRYPTO_XTS ~DM_CRYPT ~FUSE_FS for
> veracrypt.
>
>

I ended up googling and finding what several encryption programs use for
encryption and enabling all of them.  It was quite a few but if I decide
later to encrypt my /home, I think I have all that enabled plus what
veracrypt needs as well.  I haven't rebooted yet tho.  It's on my todo
list.  I'll get to see then if I got everything or not.  If not, I'll
rinse and repeat. 

Thanks for the info.

Dale

:-)  :-)