Re: [gentoo-user] cryptsetup wont use aes-xts:plain64

[Heiko Baums <lists@baums-on-web.de>]

Am 18.04.2015 um 14:12 schrieb Ralf:

> No. Could you please explain why you think so?
> Even if your root partition is encrypted, your ramdisk could load the
> modules.

Are you sure about that? Are you sure that the necessary modules are
definitely put into the initrd and that the kernel will be able to load
them soon enough at boot time?

Compiling those modules into the kernel is definitely more secure (in
terms of being sure that they are always available) and doesn't do any
harm, because they need to be loaded anyway.

Btw., several dm-crypt/LUKS documentation (all that I've read) say that
those modules have to be compiled into the kernel directly.

> After loading the modules you can see that they are available by cat
> /proc/crypto.

You won't be able to run this command when the kernel tries to unlock
the LUKS container at boot time.

> The modules can be loaded _after_ bootup as well.

If you want to unlock the LUKS container at boot time (particularly if
your root partition is encrypted), loading the modules after bootup is
too late.

So I wouldn't risk it.