invalid crypttab generated when using XTS mode
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
cryptsetup (Ubuntu) |
New
|
Undecided
|
Unassigned |
Bug Description
While installing Xenial with the latest daily ISO, I created a cryptsetup partition to be used for swap. I used a random key and picked AES 128 in XTS mode. This resulted in this line of crypttab
nvme0n1p3_crypt /dev/nvme0n1p3 /dev/urandom cipher=
During boot, systemd asked me to provide the passphrase to unlock that partition (duh). Here is how to manually reproduce the problem (replace nvme0n1p3 to match your system):
# /lib/systemd/
Set cipher aes, mode xts-plain64, key size 128 bits for device /dev/nvme0n1p3.
Failed to activate with key file '/dev/urandom': Invalid argument
Please enter passphrase for disk nvme0n1p3_crypt on none!
After much fiddling, it appears that "size=128" is too small for XTS mode. According to the cryptsetup man page, XTS requires the key to be twice as long as the cipher. Here is some evidence to back the man page:
# /lib/systemd/
Set cipher aes, mode xts-plain64, key size 256 bits for device /dev/nvme0n1p3.
# /lib/systemd/
Set cipher aes, mode xts-plain64, key size 512 bits for device /dev/nvme0n1p3.
Workaround:
sed -i '/swap/ s/size=
systemctl daemon-reload
systemctl start systemd-
Finally, I opened the bug on cryptsetup but I feel it belongs to the installer but don't know which package exactly.