therealromster / cryptsetup

Automatically exported from code.google.com/p/cryptsetup
GNU General Public License v2.0
0 stars 0 forks source link

cryptsetup-1.6.6 does not open LUKS ecb-mode partitions #238

Closed GoogleCodeExporter closed 9 years ago

GoogleCodeExporter commented 9 years ago
Hi, 

on the Arch forum there is a thread with two users failing to open devices with 
ECB mode (one ecb-plain and one ecb-benbi). Both users apparently had a working 
blockdevice up incl. 1.6.4.

I just searched and apparently they did not report it here. To me the problem 
looks very similar to issue #222 and the issues reported on the mailing list 
following the 1.6.5 release. 

If you have time, please have a look at the thread (it has --debug output): 
https://bbs.archlinux.org/viewtopic.php?id=186296

I have not tried to reproduce it yet, but can test on the distro to help with 
this if it makes sense. If you think it is a bogus problem, just mark this as 
invalid - no big deal for me. 

Regards,
Ingo

Original issue reported on code.google.com by randomic...@gmail.com on 21 Dec 2014 at 12:37

GoogleCodeExporter commented 9 years ago
Well, if it is reproducible, it should be fixed. I will try to check it.

But using ECB mode is very insecure (and it was never default)... I wonder what 
was the reason to use it.

Original comment by gmazyl...@gmail.com on 21 Dec 2014 at 3:53

GoogleCodeExporter commented 9 years ago
My first bet on why it was used would be disk throughput. 

I just tried it with the same result. 

With cryptsetup 1.6.6: 
 cryptsetup luksFormat /dev/sdab -c aes-ecb-plain
and 
 cryptsetup luksFormat /dev/sdab -c aes-ecb-benbi
fails with "Command failed with code 5: Input/output error"

When I downgrade to 1.6.4 both fly. 

Original comment by randomic...@gmail.com on 22 Dec 2014 at 12:36

Attachments:

GoogleCodeExporter commented 9 years ago
To note: When I reproduced it post above, it was with a grsec kernel - which 
sometimes can give funny results. But not in this case. The same error sticks 
with Linux 3.17.6-1-ARCH i686. 

Original comment by randomic...@gmail.com on 22 Dec 2014 at 5:02

GoogleCodeExporter commented 9 years ago
I think the problem here is that ECB mode should not have IV defined.
So correct specification is "-c aes-ecb" (and this should work).

Unfortunately, dmcrypt accepts ecb with _any_ IV spec (even nonsensical) so 
cryptsetup should at least support what was previously possible in LUKS 
header...

Original comment by gmazyl...@gmail.com on 15 Jan 2015 at 11:50

GoogleCodeExporter commented 9 years ago
I hope it is fixed by this commit
https://code.google.com/p/cryptsetup/source/detail?r=979aec773e5903c20225f700f22
c6fae85ed7bf8#

Please let me know, if there is still any problem, thanks.

Original comment by gmazyl...@gmail.com on 15 Jan 2015 at 12:29

GoogleCodeExporter commented 9 years ago
Just to confirm: all works now, thanks! 

- After formatting with 1.6.4 and "-c aes-ecb-benbi" & "-c aes-ecb-plain" 
(which show in luksDump rather than "ecb" only), both open again with the git 
version. 
- Formatting with git-version a "-c aes-ecb-benbi" gets stripped to "ecb" in 
the header. 
- Formatting with "-c aes-ecb" is/was functional in 1.6.6 here as well, yes. 

Original comment by randomic...@gmail.com on 28 Jan 2015 at 11:20