De acordo com o rascunho oficial da documentação :
LUKS2 is the second version of the Linux Unified Key Setup for disk encryp- tion management. It is the follow-up of the LUKS1 [1, 2] format that extends capabilities of the on-disk format and removes some known problems and lim- itations. Most of the basic concepts of LUKS1 remain in place as designed in New Methods in Hard Disk Encryption 2 by Clemens Fruhwirth. LUKS provides a generic key store on the dedicated area on a disk, with the ability to use multiple passphrases 1 to unlock a stored key. LUKS2 extends this concept for more flexible ways of storing metadata, redundant information to provide recovery in the case of corruption in a metadata area, and an interface to store externally managed metadata for integration with other tools. While the implementation of LUKS2 is intended to be used with Linux-based dm-crypt 3 disk encryption, it is a generic format
Basicamente, embora já esteja disponível, é um formato de trabalho em andamento pelos padrões de usuário / definição. Além disso, citando as notas oficiais da versão cryptsetup para a versão 2.0.0 , apenas 6 meses atrás (ênfase minha):
Cryptsetup 2.0.0 Release Notes
Stable release with experimental features.
This version introduces a new on-disk LUKS2 format.
The legacy LUKS (referenced as LUKS1) will be fully supported forever as well as a traditional and fully backward compatible format.
NOTE: This version changes soname of libcryptsetup library and increases major version for all public symbols. Most of the old functions are fully backward compatible, so only recompilation of programs should be needed.
Please note that authenticated disk encryption, non-cryptographic data integrity protection (dm-integrity), use of Argon2 Password-Based Key Derivation Function and the LUKS2 on-disk format itself are new features and can contain some bugs.
To provide all security features of authenticated encryption we need better nonce-reuse resistant algorithm in kernel (see note below). For now, please use authenticated encryption as experimental feature.
Please do not use LUKS2 without properly configured backup or in production systems that need to be compatible with older systems.
Então, a menos que você precise de um dos novos recursos, seu melhor & A opção mais segura seria com o padrão / estável LUKS1 . Por outro lado, se você não se importar com um pouco de testes ou problemas com a configuração, você pode usar a opção LUKS2 e relatar quaisquer problemas encontrados na transferidor de problemas do cryptsetup .