V8.00.000.2025.06.17

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>

func/partitioning/3220_partition_encryption.sh

@@ -80,11 +80,15 @@ partition_encryption() {
 
       if [[ "${var_mount_path,,}" == "/boot" ]]; then
         ary_luks_opts=( --key-file "${DIR_CNF}/password_luks_boot.txt" )
+        ary_luks_opts+=(
+          --iter-time "${VAR_ITER_TIME:-3000}"
+        )
       else
         ary_luks_opts=( --key-file "${DIR_CNF}/password_luks_common.txt" )
         ary_luks_opts+=(
           --pbkdf-parallel "${VAR_KDF_THREADS:-1}"
           --pbkdf-memory "${VAR_KDF_MEMORY:-4}"
+          --pbkdf-force-iterations "${VAR_KDF_ITERATIONS:-4}"
         )
       fi
 
@@ -92,13 +96,11 @@ partition_encryption() {
         --type luks2
         --cipher "${var_encryption_cipher:-aes-xts-plain64}"
         --hash "${var_encryption_hash:-sha512}"
-        --iter-time "${VAR_ITER_TIME:-3000}"
         --key-size "${var_encryption_key:-512}"
         --label "${var_encryption_label}"
         --luks2-keyslots-size "${var_encryption_slot:-16777216}"
         --luks2-metadata-size "${var_encryption_meta:-4194304}"
         --pbkdf "${var_encryption_pbkdf:-argon2id}"
-        --pbkdf-force-iterations "${VAR_KDF_ITERATIONS:-4}"
         "--${var_encryption_rng}"
         --batch-mode
         --verbose