Public bug reported:
While installing Xenial with the latest daily ISO, I created a
cryptsetup partition to be used for swap. I used a random key and picked
AES 128 in XTS mode. This resulted in this line of crypttab
nvme0n1p3_crypt /dev/nvme0n1p3 /dev/urandom cipher=aes-xts-
plain64,swap,size=128,discard
During boot, systemd asked me to provide the passphrase to unlock that
partition (duh). Here is how to manually reproduce the problem (replace
nvme0n1p3 to match your system):
# /lib/systemd/systemd-cryptsetup attach 'nvme0n1p3_crypt' '/dev/nvme0n1p3'
'/dev/urandom' 'cipher=aes-xts-plain64,swap,size=128,discard'
Set cipher aes, mode xts-plain64, key size 128 bits for device /dev/nvme0n1p3.
Failed to activate with key file '/dev/urandom': Invalid argument
Please enter passphrase for disk nvme0n1p3_crypt on none!
After much fiddling, it appears that "size=128" is too small for XTS
mode. According to the cryptsetup man page, XTS requires the key to be
twice as long as the cipher. Here is some evidence to back the man page:
# /lib/systemd/systemd-cryptsetup attach 'nvme0n1p3_crypt' '/dev/nvme0n1p3'
'/dev/urandom' 'cipher=aes-xts-plain64,size=256,swap,discard'
Set cipher aes, mode xts-plain64, key size 256 bits for device /dev/nvme0n1p3.
# /lib/systemd/systemd-cryptsetup attach 'nvme0n1p3_crypt' '/dev/nvme0n1p3'
'/dev/urandom' 'cipher=aes-xts-plain64,size=512,swap,discard'
Set cipher aes, mode xts-plain64, key size 512 bits for device /dev/nvme0n1p3.
Workaround:
sed -i '/swap/ s/size=128/size=256/' /etc/crypttab
systemctl daemon-reload
systemctl start systemd-cryptsetup@nvme0n1p3_crypt
Finally, I opened the bug on cryptsetup but I feel it belongs to the installer
but don't know which package exactly.
** Affects: cryptsetup (Ubuntu)
Importance: Undecided
Status: New
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1647004
Title:
invalid crypttab generated when using XTS mode
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/cryptsetup/+bug/1647004/+subscriptions
--
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
