Calamares Installer Adds LUKS Encryption Support

[phoronix]

Phoronix: Calamares Installer Adds LUKS Encryption Support

The Calamares installer framework continues to see more distributions adopt it as their installer, so it's good hearing this weekend that it's finally onto supporting LUKS encryption...

http://www.phoronix.com/scan.php?page=news_item&px=Calamares-LUKS-Support

[stikonas]

Both Calamares and KDE partition manaager share partitioning code (KPMcore). So KDE Partition Manager also supports LUKS partitions. Including resizing them:

https://www.youtube.com/watch?v=ZwiyCC9gvHM

[Guest]

"Besides, the performance impact is nominal with modern hardware -- e.g. a CPU supporting AES-NI"

It's funny how both my lower-end AMD APU machines support AES-NI, and yet a Haswell laptop I have (with a newer CPU than both APUs) doesn't. Not sure what it is about Intel and CPU instructions...

[damonlynch]

I use LUKS to encrypt several partitions. However for now I've given up the use of TRIM on the LUKS SSD partition. Is it easy (and safe) enough to use TRIM & LUKS?

[stikonas]

I use LUKS to encrypt several partitions. However for now I've given up the use of TRIM on the LUKS SSD partition. Is it easy (and safe) enough to use TRIM & LUKS?

It's not really safe, enabling TRIM might leak e.g. what filesystem is used inside and maybe some other info... In principle enabling TRIM is just adding some options to crypttab/fstab. But we won't be doing this by default in Calamares/KDE Partition Manager.

By the way, Calamares actually uses full system encryption. And by full I mean including /boot.

[OlafLostViking]

By the way, Calamares actually uses full system encryption. And by full I mean including /boot.

Are you using some selfmade kexec/initrd approach? Are 2F-authentications supported? Or are you using grub's password/LUKS support? Or something completely different?

Edit: Ah, I see. I watched the video and you're using grub's LUKS support.

[garegin]

Can somone explain to me the point of using encryption software instead of old fashioned bios based drive encryption.
Is seems that no one uses that anymore, even though it's available everywhere

[uid313]

"Besides, the performance impact is nominal with modern hardware -- e.g. a CPU supporting AES-NI"

It's funny how both my lower-end AMD APU machines support AES-NI, and yet a Haswell laptop I have (with a newer CPU than both APUs) doesn't. Not sure what it is about Intel and CPU instructions...

Maybe it is only for Intel vPro or some dumb shit like that.

[uid313]

What distributions use the Calamares installer?

Manarjo Linux based on Arch Linux.
Sabayon Linux based on Gentoo Linux.

Any other?

[stqn]

Can somone explain to me the point of using encryption software instead of old fashioned bios based drive encryption.
Is seems that no one uses that anymore, even though it's available everywhere

What are you talking about? I’ve never seen any encryption option in any BIOS.