Bug#1126717:

[Pascal Hambourg]

On 04/02/2026 at 19:07, IRONALEKS wrote:

once i am able to get an installation iso with the fix, i
will test it


You can test with this amd64 mini.iso netboot image (network is required 
during installation):

Bug#1126717:

[IRONALEKS]

Yes, thank you, add your fix to your merge request. I am not a debian
expert so i really don't know how to test it before a installation iso is
released, but once i am able to get an installation iso with the fix, i
will test it :)

Bug#1126717: partman-crypto: random key encrypted swap using xts doesn't double the key size in the final /etc/crypttab

[Pascal Hambourg]

On 31/01/2026 at 15:16, Aleks wrote:


I selected the option aes+xts and the random key option and a key size
of 256. I know that doing so for my root partition worked fine, it used
luks and used a doubled key (in my case i selected 256 and it doubled it
to 512)


TIL: "XTS mode takes two keys, hence the key sizes are double that for 
other modes and half of it is the cipher key, the other half is the XTS 
key" (from cryptsetup FAQ). For a 256-bit cipher key, you must specify a 
512-bit key size to cryptsetup.



But when i check in /etc/crypttab i see that even though i also used
256 for the swap partition, it didn't double it and it still says 256.



/etc/crypttab entry after finishing the debian installation is as follows:
sda4_crypt /dev/sda4 /dev/urandom 
cipher=aes-xts-plain64,size=256,swap,discard,x-initrd.attach
Indeed, if XTS mode is selected then setup_luks() in lib/crypto_base.sh 
doubles the key size when formatting an encrypted volume with 
LUKS+passphrase and setup_dmcrypt() does the same when opening an 
encrypted volume with plain dm-crypt+random key; however 
crypttab_add_entry() in finish.d/crypto_config does not double the key 
size when writing a crypttab entry for plain dm-crypt+random key. It 
looks like commit 1cd80dd8 ("Also double key size for non-luks xts") was 
incomplete.


I can add a trivial fix to my pending plain dm-crypt enhancements and 
bugfixes (MR !4).

Bug#1126717:

[IRONALEKS]

i forgot to mention that it is aes-xts
If it help somehow, my final /etc/crypttab entry after finishing the debian
installation is as follows:
sda4_crypt /dev/sda4 /dev/urandom
cipher=aes-xts-plain64,size=256,swap,discard,x-initrd.attach

Bug#1126717: partman-crypto: (Debian sinstallation)random key encrypted swap using xts doesn't double the key size in the final /etc/crypttab

[Aleks]

Source: partman-crypto
Version: 134
Severity: important
X-Debbugs-Cc: 8ironale...@gmail.com

Dear Maintainer,

When installing debian using the default iso i wanted to setup an encrypted 
swap.
I selected the option aes and the random key option and a key size of 256. I 
know that doing so for my root partition worked fine, it used luks and used a 
doubled key(in my case i selected 256 and it doubled it to 512)
But when i check in /etc/crypttab i see that even though i also used 256 for 
the swap partition, it didn't double it and it still says 256.
I guess it's not that much of a problem if you use 256, but if you use 128 it 
may be a securty problem perhaps
I expected the final /etc/crypttab to contain a doubled key size, but it didn't

-- System Information:
Debian Release: 13.3
  APT prefers stable-updates
  APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 6.12.63+deb13-amd64 (SMP w/4 CPU threads; PREEMPT)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled