V8.00.000.2025.06.17

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
2025-07-27 21:53:41 +02:00
parent 9b03340d7f
commit b9ac2988c2
6 changed files with 70 additions and 52 deletions
--- a/.preseed/partitioning.yaml
+++ b/.preseed/partitioning.yaml
@@ -29,6 +29,9 @@ recipe:
      description: "CISS 2025 - GPT - BTRFS - Ephemeral - non RAID - 256GiB - rescue"
      firmware: "UEFI"         # MUST be "UEFI" for "gpt" || "BIOS":
      id: "guben0afx256r"      # MUST be equal to the second part of the recipe-variables string.
+      kdf:
+        threads: 1             # Set the parallel cost for PBKDF (number of threads, up to 4).
+        time: 2048             # The number of milliseconds to spend with PBKDF passphrase processing.
      name: "ciss.2025.gpt.btrfs.ephemeral.non-raid.256GiB.rescue"
      nuke: true               # Activates Nuke-Mechanism in '/etc/crypttab' keyscript and via dropbear SSH forced command.
      raid:                    # mdadm RAID settings only (not yet supported).
@@ -41,7 +44,7 @@ recipe:
      table: "gpt"             # MUST be "gpt" for "UEFI" || "msdos":
      syntax: true             # This is set to "false" by default, otherwise if the recipe is tested by the authors to "true".
      ### Version of the specific recipe.
-      version: "1.1.9"
+      version: "1.2.0"
    dev:
      sda:
        1:
@@ -54,12 +57,10 @@ recipe:
            integrity: false   # MUST be "false" for "/boot/efi"
            cipher: ""
            hash: ""
-            itertime: ""
            key: ""
            keyslotssize: ""
            metadatasize: ""
            pbkdf: ""
-            pbkdfparallel: ""
            rng: ""
          filesystem:
            btrfs:
@@ -73,7 +74,7 @@ recipe:
            version: "fat32"
          mount:
            enable: true       # MUST be "true" for "/boot/efi"
-            options: "umask=0077,uid=0,gid=0"
+            options: "defaults,noatime,nodev,nosuid,noexec,umask=0077"
            optsnap: ""
            path: "/boot/efi"
          primary: primary
@@ -87,12 +88,10 @@ recipe:
            integrity: false   # MUST be "false" for "/boot"
            cipher: "aes-xts-plain64"
            hash: "sha512"
-            itertime: "3000"
            key: "512"
            keyslotssize: "32M"
            metadatasize: "4096k"
            pbkdf: "pbkdf2"     # MUST be "pbkdf2" for "/boot"
-            pbkdfparallel: 1
            rng: "use-random"
          filesystem:
            btrfs:
@@ -120,12 +119,10 @@ recipe:
            integrity: false
            cipher: "aes-xts-plain64"
            hash: "sha512"
-            itertime: "3000"
            key: "512"
            keyslotssize: "32M"
            metadatasize: "4096k"
            pbkdf: "argon2id"
-            pbkdfparallel: 1
            rng: "use-random"
          filesystem:
            btrfs:
@@ -154,12 +151,10 @@ recipe:
            integrity: false   # MUST be "false" for ephemeral "SWAP"
            cipher: "aes-xts-plain64"
            hash: "sha512"
-            itertime: "3000"
            key: "512"
            keyslotssize: "32M"
            metadatasize: "4096k"
            pbkdf: "argon2id"
-            pbkdfparallel: 1
            rng: "use-random"
          filesystem:
            btrfs:
@@ -188,12 +183,10 @@ recipe:
            integrity: false   # MUST be "false" for ephemeral "/tmp"
            cipher: "aes-xts-plain64"
            hash: "sha512"
-            itertime: "3000"
            key: "512"
            keyslotssize: "32M"
            metadatasize: "4096k"
            pbkdf: "argon2id"
-            pbkdfparallel: 1
            rng: "use-random"
          filesystem:
            btrfs:
@@ -207,7 +200,7 @@ recipe:
            version: "ext4"    # MUST be "ext4" for ephemeral "/tmp"
          mount:
            enable: true
-            options: "defaults,rw,nodev,nosuid,noatime,discard,mode=1777"
+            options: "defaults,rw,nodev,noexec,nosuid,noatime,discard,mode=1777"
            optsnap: ""
            path: "/tmp"
          primary: primary
@@ -221,12 +214,10 @@ recipe:
            integrity: false
            cipher: "aes-xts-plain64"
            hash: "sha512"
-            itertime: "3000"
            key: "512"
            keyslotssize: "32M"
            metadatasize: "4096k"
            pbkdf: "argon2id"
-            pbkdfparallel: 1
            rng: "use-random"
          filesystem:
            btrfs:
@@ -240,7 +231,9 @@ recipe:
            version: "btrfs"
          mount:
            enable: true
-            options: "defaults,errors=remount-ro,noatime,discard=async,autodefrag"
+                               # btrfs: errors=continue
+                               # ext4 : errors=remount-ro
+            options: "defaults,errors=continue,noatime,discard=async,autodefrag"
            optsnap: "nodev,nosuid,noexec"
            path: "/"
          primary: primary
@@ -254,12 +247,10 @@ recipe:
            integrity: false
            cipher: "aes-xts-plain64"
            hash: "sha512"
-            itertime: "3000"
            key: "512"
            keyslotssize: "32M"
            metadatasize: "4096k"
            pbkdf: "argon2id"
-            pbkdfparallel: 1
            rng: "use-random"
          filesystem:
            btrfs:
@@ -287,12 +278,10 @@ recipe:
            integrity: false
            cipher: "aes-xts-plain64"
            hash: "sha512"
-            itertime: "3000"
            key: "512"
            keyslotssize: "32M"
            metadatasize: "4096k"
            pbkdf: "argon2id"
-            pbkdfparallel: 1
            rng: "use-random"
          filesystem:
            btrfs:
@@ -320,12 +309,10 @@ recipe:
            integrity: false
            cipher: "aes-xts-plain64"
            hash: "sha512"
-            itertime: "3000"
            key: "512"
            keyslotssize: "32M"
            metadatasize: "4096k"
            pbkdf: "argon2id"
-            pbkdfparallel: 1
            rng: "use-random"
          filesystem:
            btrfs:
@@ -353,12 +340,10 @@ recipe:
            integrity: false
            cipher: "aes-xts-plain64"
            hash: "sha512"
-            itertime: "3000"
            key: "512"
            keyslotssize: "32M"
            metadatasize: "4096k"
            pbkdf: "argon2id"
-            pbkdfparallel: 1
            rng: "use-random"
          filesystem:
            btrfs:
@@ -386,12 +371,10 @@ recipe:
            integrity: false
            cipher: "aes-xts-plain64"
            hash: "sha512"
-            itertime: "3000"
            key: "512"
            keyslotssize: "32M"
            metadatasize: "4096k"
            pbkdf: "argon2id"
-            pbkdfparallel: 1
            rng: "use-random"
          filesystem:
            btrfs:
@@ -419,12 +402,10 @@ recipe:
            integrity: false
            cipher: "aes-xts-plain64"
            hash: "sha512"
-            itertime: "3000"
            key: "512"
            keyslotssize: "32M"
            metadatasize: "4096k"
            pbkdf: "argon2id"
-            pbkdfparallel: 1
            rng: "use-random"
          filesystem:
            btrfs:
@@ -449,15 +430,13 @@ recipe:
          encryption:
            enable: true
            ephemeral: false
-            integrity: false
+            integrity: true
            cipher: "aes-xts-plain64"
            hash: "sha512"
-            itertime: "3000"
            key: "512"
            keyslotssize: "32M"
            metadatasize: "4096k"
            pbkdf: "argon2id"
-            pbkdfparallel: 1
            rng: "use-random"
          filesystem:
            btrfs:
--- a/ciss_debian_installer.sh
+++ b/ciss_debian_installer.sh
@@ -189,6 +189,8 @@ yaml_reader
 ### PARTITIONING
 echo "MAIN PROGRAM SEQUENCE: partitioning()"
 partitioning
+echo "MAIN PROGRAM SEQUENCE: benchmarking_encryption()"
+benchmarking_encryption
 echo "MAIN PROGRAM SEQUENCE: partition_encryption()"
 partition_encryption
 echo "MAIN PROGRAM SEQUENCE: partition_formatting()"
--- a/func/partitioning/3210_benchmarking_encryption.sh
+++ b/func/partitioning/3210_benchmarking_encryption.sh
@@ -13,15 +13,41 @@
 guard_sourcing

 #######################################
-# Benchmark cryptsetup KDF to determine pbkdf-memory and pbkdf-force-iterations
+# Benchmark cryptsetup KDF to determine pbkdf-memory and pbkdf-force-iterations for given pbkdf-threads.
+# Globals:
+#   VAR_ITER_TIME
+#   VAR_KDF_ITERATIONS
+#   VAR_KDF_MEMORY
+#   VAR_KDF_THREADS
+#   VAR_RECIPE_STRING
+#   VAR_SETUP_PART
 # Arguments:
 #   None
 # Returns:
 #   0: on success
 #######################################
 benchmarking_encryption() {
+  declare var_result=""
+  # shellcheck disable=SC2155
+  declare -girx VAR_KDF_THREADS=$(yq_val ".recipe.${VAR_RECIPE_STRING}.control.kdf.threads" "${VAR_SETUP_PART}")
+  # shellcheck disable=SC2155
+  declare -girx VAR_ITER_TIME=$(yq_val ".recipe.${VAR_RECIPE_STRING}.control.kdf.time"      "${VAR_SETUP_PART}")
+
+  echo "BENCHMARK CRYPTSETUP ARGON2ID KDF PARAMETER"
+  # shellcheck disable=SC2312
+  var_result=$(cryptsetup benchmark --pbkdf argon2id --iter-time "${VAR_ITER_TIME:-3000}" --pbkdf-parallel "${VAR_KDF_THREADS:-1}" 2>/dev/null \
+    | grep -E '^argon2id[[:space:]]+[0-9]+[[:space:]]+iterations')
+
+  echo "${var_result}"
+
+  do_log "info" "file_only" "3210() [cryptsetup benchmark --pbkdf argon2id --iter-time ${VAR_ITER_TIME:-3000} --pbkdf-parallel ${VAR_KDF_THREADS:-1}]."
+  do_log "info" "file_only" "3210() Results: [${var_result}]."
+
+  # shellcheck disable=SC2155
+  declare -girx VAR_KDF_ITERATIONS=$(awk '{print $2}' <<<"${var_result}")
+  # shellcheck disable=SC2155
+  declare -girx VAR_KDF_MEMORY=$(awk -F'[ ,]+' '{print $4}' <<<"${var_result}")

-  :
  return 0
 }
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
--- a/func/partitioning/3220_partition_encryption.sh
+++ b/func/partitioning/3220_partition_encryption.sh
@@ -17,12 +17,18 @@ guard_sourcing
 # Globals:
 #   DIR_BAK
 #   DIR_CNF
+#   DIR_LOG
 #   HMP_EPHEMERAL_DEV
 #   HMP_EPHEMERAL_ENCLABEL
 #   HMP_EPHEMERAL_FS_LABEL
 #   HMP_PATH_ENCLABEL
 #   HMP_PATH_LUKSUUID
+#   VAR_CRYPT_RECOVERY
 #   VAR_CRYPT_ROOT
+#   VAR_ITER_TIME
+#   VAR_KDF_ITERATIONS
+#   VAR_KDF_MEMORY
+#   VAR_KDF_THREADS
 #   VAR_RECIPE_STRING
 #   VAR_SETUP_PART
 # Arguments:
@@ -35,7 +41,7 @@ partition_encryption() {
  declare -Ag HMP_EPHEMERAL_DEV HMP_EPHEMERAL_ENCLABEL HMP_EPHEMERAL_FS_LABEL HMP_PATH_LUKSUUID HMP_PATH_ENCLABEL
  declare var_dev var_part \
    var_encryption_enable var_encryption_ephemeral var_encryption_integrity var_encryption_cipher \
-    var_encryption_hash var_encryption_iter var_encryption_key var_encryption_label var_encryption_meta var_encryption_cores \
+    var_encryption_hash var_encryption_key var_encryption_label var_encryption_meta \
    var_encryption_slot var_encryption_pbkdf var_encryption_rng var_filesystem_label var_mount_path var_uuid var_fs
  declare -a ary_devs=() ary_parts=() ary_luks_opts=()

@@ -58,12 +64,10 @@ partition_encryption() {
      var_encryption_integrity=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.integrity" "${VAR_SETUP_PART}")
      var_encryption_cipher=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.cipher"       "${VAR_SETUP_PART}")
      var_encryption_hash=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.hash"           "${VAR_SETUP_PART}")
-      var_encryption_iter=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.itertime"       "${VAR_SETUP_PART}")
      var_encryption_key=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.key"             "${VAR_SETUP_PART}")
      var_encryption_slot=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.keyslotssize"   "${VAR_SETUP_PART}")
      var_encryption_meta=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.metadatasize"   "${VAR_SETUP_PART}")
      var_encryption_pbkdf=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.pbkdf"         "${VAR_SETUP_PART}")
-      var_encryption_cores=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.pbkdfparallel" "${VAR_SETUP_PART}")
      var_encryption_rng=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.rng"             "${VAR_SETUP_PART}")
      var_fs=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.version"                     "${VAR_SETUP_PART}")
      var_mount_path=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.mount.path"                     "${VAR_SETUP_PART}")
@@ -78,19 +82,23 @@ partition_encryption() {
        ary_luks_opts=( --key-file "${DIR_CNF}/password_luks_boot.txt" )
      else
        ary_luks_opts=( --key-file "${DIR_CNF}/password_luks_common.txt" )
+        ary_luks_opts+=(
+          --pbkdf-parallel "${VAR_KDF_THREADS:-1}"
+          --pbkdf-memory "${VAR_KDF_MEMORY:-4}"
+        )
      fi

      ary_luks_opts+=(
        --type luks2
        --cipher "${var_encryption_cipher:-aes-xts-plain64}"
        --hash "${var_encryption_hash:-sha512}"
-        --iter-time "${var_encryption_iter:-3000}"
+        --iter-time "${VAR_ITER_TIME:-3000}"
        --key-size "${var_encryption_key:-512}"
        --label "${var_encryption_label}"
        --luks2-keyslots-size "${var_encryption_slot:-16777216}"
        --luks2-metadata-size "${var_encryption_meta:-4194304}"
        --pbkdf "${var_encryption_pbkdf:-argon2id}"
-        --pbkdf-parallel "${var_encryption_cores:-1}"
+        --pbkdf-force-iterations "${VAR_KDF_ITERATIONS:-4}"
        "--${var_encryption_rng}"
        --batch-mode
        --verbose
--- a/func/partitioning/3290_uuid_logger.sh
+++ b/func/partitioning/3290_uuid_logger.sh
@@ -25,27 +25,29 @@ guard_sourcing
 #   0: on success
 #######################################
 uuid_logger() {
-  declare var_key var_mountpoint var_uuid
-  printf 'UUID Partition:\n' >> "${LOG_UID}"
+  declare var_key="" var_mountpoint="" var_uuid=""
+
+  printf 'PARTITION UUID Partition:\n' >> "${LOG_UID}"
  for var_key in "${!HMP_PATH_PARTUUID[@]}"; do
-    ### Remove Prefix "UUID_"
+    ### Remove Prefix "PARTUUID_"
+    var_mountpoint="${var_key#PARTUUID_}"
+    var_uuid="${HMP_PATH_PARTUUID[${var_key}]}"
+    ### Left-aligned field width 63; "UUID=" starts directly after column 64.
+    printf '%-63sUUID=%s\n' "${var_mountpoint}:" "${var_uuid}" >> "${LOG_UID}"
+  done
+
+  printf '\n' >> "${LOG_UID}"
+  printf 'LUKS CONTAINER UUID:\n' >> "${LOG_UID}"
+  for var_key in "${!HMP_PATH_LUKSUUID[@]}"; do
+    ### Remove Prefix "PARTUUID_"
    var_mountpoint="${var_key#UUID_}"
-    var_uuid="${HMP_PATH_PARTUUID[${var_key}]}"
+    var_uuid="${HMP_PATH_LUKSUUID[${var_key}]}"
    ### Left-aligned field width 63; "UUID=" starts directly after column 64.
    printf '%-63sUUID=%s\n' "${var_mountpoint}:" "${var_uuid}" >> "${LOG_UID}"
  done

  printf '\n' >> "${LOG_UID}"
-  printf 'UUID LUKS Container:\n' >> "${LOG_UID}"
-  for var_key in "${!HMP_PATH_ENCLABEL[@]}"; do
-    var_mountpoint="${HMP_PATH_ENCLABEL[${var_key}]}"
-    var_uuid="${HMP_PATH_PARTUUID[${var_key}]}"
-    ### Left-aligned field width 63; "UUID=" starts directly after column 64.
-    printf '%-63sUUID=%s\n' "${var_mountpoint}:" "${var_uuid}" >> "${LOG_UID}"
-  done
-
-  printf '\n' >> "${LOG_UID}"
-  printf 'UUID Filesystem:\n' >> "${LOG_UID}"
+  printf 'FILESYSTEM UUID:\n' >> "${LOG_UID}"
  for var_key in "${!HMP_PATH_FSUUID[@]}"; do
    ### Remove Prefix "UUID_"
    var_mountpoint="${var_key#UUID_}"
--- a/meta_loader_func.sh
+++ b/meta_loader_func.sh
@@ -24,6 +24,7 @@ source_guard "./func/helper/1250_yaml_parser.sh"
 source_guard "./func/helper/1251_yaml_reader.sh"

 source_guard "./func/partitioning/3200_partitioning.sh"
+source_guard "./func/partitioning/3210_benchmarking_encryption.sh"
 source_guard "./func/partitioning/3220_partition_encryption.sh"
 source_guard "./func/partitioning/3240_partition_formatting.sh"
 source_guard "./func/partitioning/3260_setup_filesystem.sh"