Can scrypt be used as the hashing algorithm for LUKS? Can I tune its parameters? How can I do this?

  • You can use scrypt to encrypt a keyfile and then pass that on to LUKS. – frostschutz Feb 21 '15 at 13:59

No, LUKS only supports PBKDF2 as the key derivation function. PBKDF2 is built on a cryptographic hash function, and you can select the hash function with --hash, as well as the iteration count via --iter-time. All supported hash functions are equally secure for this use case; a higher iteration count makes the job proportionally harder for the attacker but also make normal mounting correspondingly slower.

There is a registered issue for LUKS to support scrypt. This is a significant change because there is no field in the on-disk format to indicate which key stretching is in use. This has been discussed briefly on the dm-crypt mailing list.

  • That's a huge relief, thank you! I'm just going to turn up the iterations to something very cumbersome, lol. – user31705 Jul 26 '14 at 21:08

Cracking Scrypt hashes is about 18,000X more expensive than cracking LUKS hashes when run for 200ms, when the attacker is using custom ASICs. To get the same protection by just increasing iterations, you'd have to let LUKS hash your password for an hour. Have fun with that :-)

LUKS should switch to Scrypt as the default, plain and simple. Don't let the comments above confuse you.


You may use whatever hashing algorithm the kernel has in stock, so the answer is in principle yes (if someone bothers to implement it in the kernel) but in practice no.

  • So, no, scrypt is not currently offered? – user31705 Jul 25 '14 at 20:58
  • 1
    No, not in current kernels. I've just looked it up (under Cryptographic API), there are MD4, MD5, GHASH, SHA-1, various variants of SHA-2 and RIPEMD, Tiger and Whirlpool. – countermode Jul 25 '14 at 21:02
  • That's...a rare disappointment. – user31705 Jul 25 '14 at 21:03
  • 1
    You're confusing password-based key derivation algorithms (such as PBKDF2 and scrypt) with hash algorithms. (Don't feel bad: a lot of literature out there, including the cryptsetup manual, is written in a confusing way.) A password-based key derivation algorithm generates key material from a password and a salt in a way that is intrinsically resource-demanding. A hash generates fixed-size output as fast as possible so that hash(M) ≠ hash(M') if M ≠ M'. – Gilles 'SO- stop being evil' Jul 26 '14 at 8:54
  • 3
    PBKDF2 happens to use a hash as one of the bricks it builds on, and cryptsetup has an option to select which hash. Scrypt isn't built on a hash function. The KDF computation is performed by cryptsetup: the kernel doesn't have the code for it. The answer is no, but that's because cryptsetup doesn't support it, the kernel wouldn't care. @Cincinnatus – Gilles 'SO- stop being evil' Jul 26 '14 at 8:55

Short answer - yes, scrypt (see wikipedia) from Tarsnap can be used for LUKS encryption. Further, scrypt has been implemented in Android 4.4+ Ref: Revisiting-android-disk-encryption. However, that doesn't answer the more important question, of how? Guidance on LUKS with scrypt on Linux Mint or Fedora greatly appreciated here.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy