Re: The official disk encryption guide seems a bit lacking (detailed list of concrete improvement suggestions!)

[nia <nia%NetBSD.org@localhost>]

On Wed, Oct 28, 2026 at 12:01:33AM +0100, Ellie wrote:
> ## 3rd thing I missed, more in-depth crypto parameter discussion:
> 
> The disk guide also suggests AES-CBC 256 instead of AES-XTS 512. That seems
> a little outdated.

I asked about this a while ago, and was told that the implementation
of AES-CBC in cgd(4) offers theoretical better security. AES-XTS
offers theoretical better performance. But I think you'll struggle
to notice the difference between the two in practice.

We should probably recommend adiantum because not-all-the-worlds-an-
x86(tm).