Control: retitle -1 crypto-modules-*-di lacks 'essiv' module (required for old default cipher aes-cbc-essiv:sha256) Control: reassign -1 src:linux
Hi Nathan, On Thu, 29 Oct 2020 at 13:17:54 -0500, Nathan Schulte wrote: > Using cryptsetup to securely wipe a device before enabling encryption, e.g.: > > cryptsetup --key-file /dev/random open --type plain /path/to/device container I hope this is not all the entire “secure wipe” operation, because AFAICT this command doesn't perform any writes to the underlying device let alone wipe it. One would need to fill /dev/mapper/container in order to wipe it in a way that's indistinguishable from random, but it's not clear to me what's the advantage over simply using `dd if=/dev/urandom of=/path/to/device` (once urandom has been properly seeded). > fails on my system during install, using the latest weekly snapshot of Debian > testing. > Some messages are logged to the terminal and some are logged by the kernel: Next time please provide --debug output, and maybe also /proc/modules content. cryptsetup(8) defaults to aes-cbc-essiv:sha256 in ‘plain’ dm-crypt mode, which AFAICT (cf. #948593) requires the ‘essiv’ kernel module. This module currently missing from crypto-modules, so aes-cbc-essiv:sha256 isn't usable from d-i. The installer doesn't have that problem since it explicitly sets aes-xts-plain64 also in ‘plain’ dm-crypt mode. Unless you're really attached to ESSIV you could pass `--cipher aes-xts-plain64` as a workaround. But I'm reassigning this to src:linux as aes-cbc-essiv:sha256 used to be the default cipher some years ago so devices created before 2013 might no longer be accessible from d-i. Cheers, -- Guilhem.
signature.asc
Description: PGP signature
