Suggestion: Add documentation about passphrase hashing hardness about fscrypt HOT 3 CLOSED

The main way hashing hardness is configured is though the --time=TIME flag to fscrypt setup. So running:

sudo fscrypt setup --time=500ms

creates hashing parameters in /etc/fscrypt.conf which will take approximately half a second to hash a password. This is in the help text and flag usage. These parameters can also be manually adjusted by editing /etc/fscrypt.conf by hand.

It is important to note that editing this config file (either manually or though fscrypt setup) only changes the hashing costs for new passphrase-based protectors (so old ones are not broken when everything changes).

I think all the functionality is there that you would need (let me know if that's not true). I'm going to turn this issue into a bug to update the documentation to make it clearer how passphrase hashing hardness works.

from fscrypt.

This documentation will probably be incorporated as part of the manpages for #10. Either under the fscrypt entry or the fscrypt-setup entry.

from fscrypt.

This does have a mention in the README now, in the "Configuration file" section. It's a bit brief, but no one else has asked about this, so I don't think we should keep this issue open separately from the one for the man page (#10).

from fscrypt.