invalid crypttab generated when using XTS mode

Bug #1647004 reported by Simon Déziel
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
cryptsetup (Ubuntu)
New
Undecided
Unassigned

Bug Description

While installing Xenial with the latest daily ISO, I created a cryptsetup partition to be used for swap. I used a random key and picked AES 128 in XTS mode. This resulted in this line of crypttab

  nvme0n1p3_crypt /dev/nvme0n1p3 /dev/urandom cipher=aes-xts-plain64,swap,size=128,discard

During boot, systemd asked me to provide the passphrase to unlock that partition (duh). Here is how to manually reproduce the problem (replace nvme0n1p3 to match your system):

# /lib/systemd/systemd-cryptsetup attach 'nvme0n1p3_crypt' '/dev/nvme0n1p3' '/dev/urandom' 'cipher=aes-xts-plain64,swap,size=128,discard'
Set cipher aes, mode xts-plain64, key size 128 bits for device /dev/nvme0n1p3.
Failed to activate with key file '/dev/urandom': Invalid argument
Please enter passphrase for disk nvme0n1p3_crypt on none!

After much fiddling, it appears that "size=128" is too small for XTS mode. According to the cryptsetup man page, XTS requires the key to be twice as long as the cipher. Here is some evidence to back the man page:

# /lib/systemd/systemd-cryptsetup attach 'nvme0n1p3_crypt' '/dev/nvme0n1p3' '/dev/urandom' 'cipher=aes-xts-plain64,size=256,swap,discard'
Set cipher aes, mode xts-plain64, key size 256 bits for device /dev/nvme0n1p3.

# /lib/systemd/systemd-cryptsetup attach 'nvme0n1p3_crypt' '/dev/nvme0n1p3' '/dev/urandom' 'cipher=aes-xts-plain64,size=512,swap,discard'
Set cipher aes, mode xts-plain64, key size 512 bits for device /dev/nvme0n1p3.

Workaround:

 sed -i '/swap/ s/size=128/size=256/' /etc/crypttab
 systemctl daemon-reload
 systemctl start systemd-cryptsetup@nvme0n1p3_crypt

Finally, I opened the bug on cryptsetup but I feel it belongs to the installer but don't know which package exactly.

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.