Commit 982b7373 authored by Ondrej Kozina's avatar Ondrej Kozina Committed by Milan Broz

Sort option descriptions in reencrypt man page.

Sort detailed option descriptions alphabetically (LANG=C)
parent 39b5359e
......@@ -52,27 +52,38 @@ To remove encryption from device, use \fI\-\-decrypt\fR.
For detailed description of encryption and key file options see \fIcryptsetup(8)\fR
man page.
.TP
.B "\-\-verbose, \-v"
Print more information on command execution.
.B "\-\-batch-mode, \-q"
Suppresses all warnings and reencryption progress output.
.TP
.B "\-\-block-size, \-B \fIvalue\fR"
Use re-encryption block size of <value> in MiB.
Values can be between 1 and 64 MiB.
.TP
.B "\-\-cipher, \-c" \fI<cipher-spec>\fR
Set the cipher specification string.
.TP
.B "\-\-debug"
Run in debug mode with full diagnostic logs. Debug output
lines are always prefixed by '#'.
.TP
.B "\-\-cipher, \-c" \fI<cipher-spec>\fR
Set the cipher specification string.
.B "\-\-decrypt"
Remove encryption (decrypt already encrypted device and remove LUKS header).
\fBWARNING:\fR This is destructive operation and cannot be reverted.
.TP
.B "\-\-key-size, \-s \fI<bits>\fR"
Set key size in bits. The argument has to be a multiple of 8.
.B "\-\-device-size \fIsize[units]\fR"
Instead of real device size, use specified value.
The possible key-sizes are limited by the cipher and mode used.
It means that only specified area (from the start of the device
to the specified size) will be reencrypted.
If you are increasing key size, there must be enough space in the LUKS header
for enlarged keyslots (data offset must be large enough) or reencryption
cannot be performed.
If no unit suffix is specified, the size is in bytes.
If there is not enough space for keyslots with new key size,
you can destructively shrink device with \-\-reduce-device-size option.
Unit suffix can be S for 512 byte sectors, K/M/G/T (or KiB,MiB,GiB,TiB)
for units with 1024 base or KB/MB/GB/TB for 1000 base (SI scale).
\fBWARNING:\fR This is destructive operation.
.TP
.B "\-\-hash, \-h \fI<hash-spec>\fR"
Specifies the hash used in the LUKS1 key setup scheme and volume key digest.
......@@ -87,10 +98,13 @@ is set to PBKDF2 (see \fI\-\-pbkdf).
The number of milliseconds to spend with PBKDF2 passphrase processing for the
new LUKS header.
.TP
.B "\-\-use-random"
.TP
.B "\-\-use-urandom"
Define which kernel random number generator will be used to create the volume key.
.B "\-\-keep-key"
Do not change encryption key, just reencrypt the LUKS header and keyslots.
This option can be combined only with \fI\-\-hash\fR, \fI\-\-iter-time\fR,
\fI\-\-pbkdf\-force\-iterations\fR, \fI\-\-pbkdf\fR (LUKS2 only),
\fI\-\-pbkdf\-memory\fR (Argon2i/id and LUKS2 only) and \fI\-\-pbkdf\-parallel\fR
(Argon2i/id and LUKS2 only) options.
.TP
.B "\-\-key-file, \-d \fIname\fR"
Read the passphrase from file.
......@@ -102,6 +116,18 @@ will be disabled in new LUKS device).
If this option is not used, cryptsetup-reencrypt will ask for all active keyslot
passphrases.
.TP
.B "\-\-key-size, \-s \fI<bits>\fR"
Set key size in bits. The argument has to be a multiple of 8.
The possible key-sizes are limited by the cipher and mode used.
If you are increasing key size, there must be enough space in the LUKS header
for enlarged keyslots (data offset must be large enough) or reencryption
cannot be performed.
If there is not enough space for keyslots with new key size,
you can destructively shrink device with \-\-reduce-device-size option.
.TP
.B "\-\-key-slot, \-S <0-MAX>"
Specify which key slot is used. For LUKS1, max keyslot number is 7. For LUKS2, it's 31.
......@@ -115,34 +141,36 @@ Read a maximum of \fIvalue\fR bytes from the key file.
Default is to read the whole file up to the compiled-in
maximum.
.TP
.B "\-\-keep-key"
Do not change encryption key, just reencrypt the LUKS header and keyslots.
.B "\-\-new, \-N"
Create new header (encrypt not yet encrypted device).
This option can be combined only with \fI\-\-hash\fR, \fI\-\-iter-time\fR,
\fI\-\-pbkdf\-force\-iterations\fR, \fI\-\-pbkdf\fR (LUKS2 only),
\fI\-\-pbkdf\-memory\fR (Argon2i/id and LUKS2 only) and \fI\-\-pbkdf\-parallel\fR
(Argon2i/id and LUKS2 only) options.
.TP
.B "\-\-tries, \-T"
Number of retries for invalid passphrase entry.
.TP
.B "\-\-block-size, \-B \fIvalue\fR"
Use re-encryption block size of <value> in MiB.
This option must be used together with \-\-reduce-device-size.
Values can be between 1 and 64 MiB.
\fBWARNING:\fR This is destructive operation and cannot be reverted.
.TP
.B "\-\-device-size \fIsize[units]\fR"
Instead of real device size, use specified value.
It means that only specified area (from the start of the device
to the specified size) will be reencrypted.
If no unit suffix is specified, the size is in bytes.
Unit suffix can be S for 512 byte sectors, K/M/G/T (or KiB,MiB,GiB,TiB)
for units with 1024 base or KB/MB/GB/TB for 1000 base (SI scale).
.B "\-\-pbkdf"
Set Password-Based Key Derivation Function (PBKDF) algorithm for LUKS keyslot.
The PBKDF can be: \fIpbkdf2\fR, \fIargon2i\fR for Argon2i or \fIargon2id\fR for Argon2id.
\fBWARNING:\fR This is destructive operation.
For LUKS1, only \fIpbkdf2\fR is accepted (no need to use this option).
.TP
.B "\-\-pbkdf\-force\-iterations <num>"
Avoid PBKDF benchmark and set time cost (iterations) directly.
.TP
.B "\-\-pbkdf\-memory <number>"
Set the memory cost for PBKDF (for Argon2i/id the number represents kilobytes).
Note that it is maximal value, PBKDF benchmark or available physical memory
can decrease it.
This option is not available for PBKDF2.
.TP
.B "\-\-pbkdf\-parallel <number>"
Set the parallel cost for PBKDF (number of threads, up to 4).
Note that it is maximal value, it is decreased automatically if
CPU online count is lower.
This option is not available for PBKDF2.
.TP
.B "\-\-progress-frequency <seconds>"
Print separate line every <seconds> with reencryption progress.
.TP
.B "\-\-reduce-device-size \fIsize[units]\fR"
Enlarge data offset to specified value by shrinking device size.
......@@ -161,17 +189,15 @@ You cannot shrink device more than by 64 MiB (131072 sectors).
\fBWARNING:\fR This is destructive operation and cannot be reverted.
Use with extreme care - shrunk filesystems are usually unrecoverable.
.TP
.B "\-\-new, \-N"
Create new header (encrypt not yet encrypted device).
This option must be used together with \-\-reduce-device-size.
\fBWARNING:\fR This is destructive operation and cannot be reverted.
.B "\-\-tries, \-T"
Number of retries for invalid passphrase entry.
.TP
.B "\-\-decrypt"
Remove encryption (decrypt already encrypted device and remove LUKS header).
.B "\-\-type <type>"
Use only while encrypting not yet encrypted device (see \-\-new).
\fBWARNING:\fR This is destructive operation and cannot be reverted.
Specify LUKS version when performing in-place encryption. If the parameter
is omitted default value (LUKS1) is used. Type may be one of: \fBluks\fR (default),
\fBluks1\fR or \fBluks2\fR.
.TP
.B "\-\-use-directio"
Use direct-io (O_DIRECT) for all read/write data operations related
......@@ -184,9 +210,10 @@ operations (e.g. in virtual environments).
Use fsync call after every written block. This applies for reencryption
log files as well.
.TP
.B "\-\-write-log"
Update log file after every block write. This can slow down reencryption
but will minimize data loss in the case of system crash.
.B "\-\-use-random"
.TP
.B "\-\-use-urandom"
Define which kernel random number generator will be used to create the volume key.
.TP
.B "\-\-uuid" \fI<uuid>\fR
Use only while resuming an interrupted decryption process (see \-\-decrypt).
......@@ -194,42 +221,15 @@ Use only while resuming an interrupted decryption process (see \-\-decrypt).
To find out what \fI<uuid>\fR to pass look for temporary files LUKS-<uuid>.[|log|org|new]
of the interrupted decryption process.
.TP
.B "\-\-batch-mode, \-q"
Suppresses all warnings and reencryption progress output.
.TP
.B "\-\-progress-frequency <seconds>"
Print separate line every <seconds> with reencryption progress.
.TP
.B "\-\-type <type>"
Use only while encrypting not yet encrypted device (see \-\-new).
Specify LUKS version when performing in-place encryption. If the parameter
is omitted default value (LUKS1) is used. Type may be one of: \fBluks\fR (default),
\fBluks1\fR or \fBluks2\fR.
.B "\-\-verbose, \-v"
Print more information on command execution.
.TP
.B "\-\-version"
Show the program version.
.TP
.B "\-\-pbkdf"
Set Password-Based Key Derivation Function (PBKDF) algorithm for LUKS keyslot.
The PBKDF can be: \fIpbkdf2\fR, \fIargon2i\fR for Argon2i or \fIargon2id\fR for Argon2id.
For LUKS1, only \fIpbkdf2\fR is accepted (no need to use this option).
.TP
.B "\-\-pbkdf\-force\-iterations <num>"
Avoid PBKDF benchmark and set time cost (iterations) directly.
.TP
.B "\-\-pbkdf\-memory <number>"
Set the memory cost for PBKDF (for Argon2i/id the number represents kilobytes).
Note that it is maximal value, PBKDF benchmark or available physical memory
can decrease it.
This option is not available for PBKDF2.
.TP
.B "\-\-pbkdf\-parallel <number>"
Set the parallel cost for PBKDF (number of threads, up to 4).
Note that it is maximal value, it is decreased automatically if
CPU online count is lower.
This option is not available for PBKDF2.
.B "\-\-write-log"
Update log file after every block write. This can slow down reencryption
but will minimize data loss in the case of system crash.
.SH RETURN CODES
Cryptsetup-reencrypt returns 0 on success and a non-zero value on error.
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment