Cryptsetup 2.8.7 Released To Deal With Fallout Of Linux's Rushed AF_ALG Deprecation

Linux's cryptsetup for configuring and managing encrypted storage devices is ready with a new version as the developers work to deal with the recent deprecation of the Linux AF_ALG interface.

Cryptsetup has been one of the users of AF_ALG for providing user-space applications with direct access to the Linux kernel's internal cryptography API. But various aspects of AF_ALG have been quickly removed in the name of security concerns and in Linux 7.2 AF_ALG was deprecated due to its "massive attack surface". For Linux 7.3, AF_ALG is being further optionally restricted via a new sysctl tunable. This leaves user-space software like Cryptsetup and AF_ALG with challenges as they have long relied on this interface now deemed too large of a security burden.

With today's Cryptsetup 2.8.7 release, they have begun adapting the code to ensure it can survive without AF_ALG and fallback well to a user-space crypto library. There are currently some limitations in the user-space library approach as noted in the v2.8.7 release notes:

"Changes related to Linux kernel AF_ALG crypto userspace interface deprecation Linux kernel maintainers decided to deprecate the AF_ALG interface, which was heavily used by cryptsetup, with the plan to remove it (or severely limit it) for security reasons. Libcryptsetup uses userspace (primarily via AF_ALG) for processing LUKS keyslots and for on-disk metadata handling for other formats. Using AF_ALG ensured that the same set of algorithms is present in userspace and later in-kernel for device activation.

While libcryptsetup has a concept of fallback to userspace library, it was not used in all situations.

In this version, libcryptsetup can use a userspace crypto library, AF_ALG (if present), and in some situations (LUKS keyslots), fallback to a temporary dm-crypt mapping. The last option requires root privileges. This ensures that most operations will continue to work even when AF_ALG is disabled or limited.

Unfortunately, removing the AF_ALG could cause severe compatibility issues if the required algorithm (or encryption mode) is not implemented in the userspace library. A typical example is the Adiantum cipher, which is implemented only in the kernel. Also, ciphers like Serpent or Twofish (in XTS mode) are missing from several userspace libraries. The cryptsetup benchmark for ciphers is no longer available if the AF_ALG interface is unavailable."

Beyond dealing with AF_ALG quickly going away, Cryptsetup 2.8.7 brings keyring handling changes, changes to deal with possible LUKS volume key digest collisions, Aria and Camellia cipher support in the libgcrypt backend, and other fixes.

Cryptsetup 2.8.7 can be downloaded from GitLab.