You are not logged in.
- Topics: Active | Unanswered
#1 2021-03-06 12:34:21
- ua4000
- Member
- Registered: 2015-10-14
- Posts: 562
[SOLVED] cryptsetup + lts-5.10.20-1 = No key available with this
Since update to linux-lts-5.10.20-1-x86_64
I got from my luks2 encrypted loop file with cryptsetup open --type luks2:
No key available with this passphrase.Downgrading package linux-lts (5.10.20-1 => 5.10.19-1) solved my issiue
I have my password in a protected text file and doing copy and paste to that terminal.
Any ideas ?
[SOLVED]
Passphrases over ~64 bytes can't unlock keys with kernel 5.11.3/5.10.20
https://gitlab.com/cryptsetup/cryptsetup/-/issues/627
Last edited by ua4000 (2021-03-06 16:19:55)
Offline
#2 2021-03-06 13:02:37
- loqs
- Member
- Registered: 2014-03-06
- Posts: 19,016
Re: [SOLVED] cryptsetup + lts-5.10.20-1 = No key available with this
Have you rebooted since the update to 5.10.20-1 so the kernel version and modules match?
Offline
#3 2021-03-06 13:08:26
- ua4000
- Member
- Registered: 2015-10-14
- Posts: 562
Re: [SOLVED] cryptsetup + lts-5.10.20-1 = No key available with this
yes of course. I'm now doing a backup, then I will do some more testing.
Offline
#4 2021-03-06 13:21:19
- loqs
- Member
- Registered: 2014-03-06
- Posts: 19,016
Re: [SOLVED] cryptsetup + lts-5.10.20-1 = No key available with this
Add the --debug option and compare the outputs. Post what you can share after redacting.
Offline
#5 2021-03-06 13:28:08
- heftig
- Developer
- From: Germany
- Registered: 2010-04-19
- Posts: 159
Re: [SOLVED] cryptsetup + lts-5.10.20-1 = No key available with this
Is your passphrase very long?
Offline
#6 2021-03-06 13:33:21
- ua4000
- Member
- Registered: 2015-10-14
- Posts: 562
Re: [SOLVED] cryptsetup + lts-5.10.20-1 = No key available with this
I did several reboots with .19 and .20 - cryptsetup won't open it with .20
I added two further keyslots, all with different password, less complex than the 1st one,
keyslot 0: PBKDF: argon2i Key: 256 bits Cipher: aes-xts-plain64 Cipher key: 256 bits password length=128
keyslot 1: PBKDF: argon2i Key: 256 bits Cipher: aes-xts-plain64 Cipher key: 256 bits password length=64
keyslot 2: PBKDF: pbkdf2 Key: 256 bits Cipher: aes-xts-plain64 Cipher key: 256 bits password length=64--> with .20 none of the three passwords is working.
Offline
#7 2021-03-06 13:50:10
- heftig
- Developer
- From: Germany
- Registered: 2010-04-19
- Posts: 159
Re: [SOLVED] cryptsetup + lts-5.10.20-1 = No key available with this
Does this kernel work? https://pkgbuild.com/~heftig/lts2/
Offline
#8 2021-03-06 14:14:30
- ua4000
- Member
- Registered: 2015-10-14
- Posts: 562
Re: [SOLVED] cryptsetup + lts-5.10.20-1 = No key available with this
.19 - working
$ sudo cryptsetup open --debug --type luks2 --allow-discards "${sourcedev}" "${mapper}"
# cryptsetup 2.3.4 processing "cryptsetup open --debug --type luks2 --allow-discards /dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi0-0-0-0-part4 cd1"
# Running command open.
# Locking memory.
# Installing SIGINT/SIGTERM handler.
# Unblocking interruption on signal.
# Allocating context for crypt device /dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi0-0-0-0-part4.
# Trying to open and read device /dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi0-0-0-0-part4 with direct-io.
# Initialising device-mapper backend library.
# Trying to load LUKS2 crypt type from device /dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi0-0-0-0-part4.
# Crypto backend (OpenSSL 1.1.1j 16 Feb 2021) initialized in cryptsetup library version 2.3.4.
# Detected kernel Linux 5.10.19-1-lts x86_64.
# Loading LUKS2 header (repair disabled).
# Acquiring read lock for device /dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi0-0-0-0-part4.
# Opening lock resource file /run/cryptsetup/L_8:4
# Verifying lock handle for /dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi0-0-0-0-part4.
# Device /dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi0-0-0-0-part4 READ lock taken.
# Trying to read primary LUKS2 header at offset 0x0.
# Opening locked device /dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi0-0-0-0-part4
# Veryfing locked device handle (bdev)
# LUKS2 header version 2 of size 16384 bytes, checksum sha256.
# Checksum:832b... (on-disk)
# Checksum:832b... (in-memory)
# Trying to read secondary LUKS2 header at offset 0x4000.
# Reusing open ro fd on device /dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi0-0-0-0-part4
# LUKS2 header version 2 of size 16384 bytes, checksum sha256.
# Checksum:032f92... (on-disk)
# Checksum:032f92... (in-memory)
# Device size 498213060608, offset 16777216.
# Device /dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi0-0-0-0-part4 READ lock released.
# PBKDF argon2i, time_ms 2000 (iterations 0), max_memory_kb 1048576, parallel_threads 4.
# Activating volume cd1 using token -1.
# Interactive passphrase entry requested.
Enter passphrase for /dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi0-0-0-0-part4:
# Activating volume cd1 [keyslot -1] using passphrase.
# dm version [ opencount flush ] [16384] (*1)
# dm versions [ opencount flush ] [16384] (*1)
# Detected dm-ioctl version 4.43.0.
# Detected dm-crypt version 1.22.0.
# Device-mapper backend running with UDEV support enabled.
# dm status cd1 [ opencount noflush ] [16384] (*1)
# Keyslot 0 priority 1 != 2 (required), skipped.
# Keyslot 1 priority 1 != 2 (required), skipped.
# Keyslot 2 priority 1 != 2 (required), skipped.
# Trying to open LUKS2 keyslot 0.
# Reading keyslot area [0x8000].
# Acquiring read lock for device /dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi0-0-0-0-part4.
# Opening lock resource file /run/cryptsetup/L_8:4
# Verifying lock handle for /dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi0-0-0-0-part4.
# Device /dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi0-0-0-0-part4 READ lock taken.
# Reusing open ro fd on device /dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi0-0-0-0-part4
# Device /dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi0-0-0-0-part4 READ lock released.
# Verifying key from keyslot 0, digest 0.
# Digest 0 (pbkdf2) verify failed with -1.
# Trying to open LUKS2 keyslot 1.
# Reading keyslot area [0x28000].
# Acquiring read lock for device /dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi0-0-0-0-part4.
# Opening lock resource file /run/cryptsetup/L_8:4
# Verifying lock handle for /dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi0-0-0-0-part4.
# Device /dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi0-0-0-0-part4 READ lock taken.
# Reusing open ro fd on device /dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi0-0-0-0-part4
# Device /dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi0-0-0-0-part4 READ lock released.
# Verifying key from keyslot 1, digest 0.
# Loading key (32 bytes, type logon) in thread keyring.
# dm versions [ opencount flush ] [16384] (*1)
# dm status cd1 [ opencount noflush ] [16384] (*1)
# Calculated device size is 973039616 sectors (RW), offset 32768.
# DM-UUID is CRYPT-LUKS2-457e80e73b6e4bac989cdc95677d7cab-cd1
# Udev cookie 0xd4d35ef (semid 2) created
# Udev cookie 0xd4d35ef (semid 2) incremented to 1
# Udev cookie 0xd4d35ef (semid 2) incremented to 2
# Udev cookie 0xd4d35ef (semid 2) assigned to CREATE task(0) with flags DISABLE_LIBRARY_FALLBACK (0x20)
# dm create cd1 CRYPT-LUKS2-457e80e73b6e4bac989cdc95677d7cab-cd1 [ opencount flush ] [16384] (*1)
# dm reload (254:0) [ opencount flush securedata ] [16384] (*1)
# dm resume cd1 [ opencount flush securedata ] [16384] (*1)
# cd1: Stacking NODE_ADD (254,0) 0:0 0600 [trust_udev]
# cd1: Stacking NODE_READ_AHEAD 256 (flags=1)
# Udev cookie 0xd4d35ef (semid 2) decremented to 1
# Udev cookie 0xd4d35ef (semid 2) waiting for zero
# Udev cookie 0xd4d35ef (semid 2) destroyed
# cd1: Skipping NODE_ADD (254,0) 0:0 0600 [trust_udev]
# cd1: Processing NODE_READ_AHEAD 256 (flags=1)
# cd1 (254:0): read ahead is 256
# cd1: retaining kernel read ahead of 256 (requested 256)
Key slot 1 unlocked.
# Releasing crypt device /dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi0-0-0-0-part4 context.
# Releasing device-mapper backend.
# Closing read only fd for /dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi0-0-0-0-part4.
# Unlocking memory.
Command successful. .20 not working, only 1 password try:
$ sudo cryptsetup open --debug --type luks2 --allow-discards "${sourcedev}" "${mapper}"
# cryptsetup 2.3.4 processing "cryptsetup open --debug --type luks2 --allow-discards /dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi0-0-0-0-part4 cd1"
# Running command open.
# Locking memory.
# Installing SIGINT/SIGTERM handler.
# Unblocking interruption on signal.
# Allocating context for crypt device /dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi0-0-0-0-part4.
# Trying to open and read device /dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi0-0-0-0-part4 with direct-io.
# Initialising device-mapper backend library.
# Trying to load LUKS2 crypt type from device /dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi0-0-0-0-part4.
# Crypto backend (OpenSSL 1.1.1j 16 Feb 2021) initialized in cryptsetup library version 2.3.4.
# Detected kernel Linux 5.10.20-1-lts x86_64.
# Loading LUKS2 header (repair disabled).
# Acquiring read lock for device /dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi0-0-0-0-part4.
# Opening lock resource file /run/cryptsetup/L_8:4
# Verifying lock handle for /dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi0-0-0-0-part4.
# Device /dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi0-0-0-0-part4 READ lock taken.
# Trying to read primary LUKS2 header at offset 0x0.
# Opening locked device /dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi0-0-0-0-part4
# Veryfing locked device handle (bdev)
# LUKS2 header version 2 of size 16384 bytes, checksum sha256.
# Checksum:832b6f... (on-disk)
# Checksum:832b6f... (in-memory)
# Trying to read secondary LUKS2 header at offset 0x4000.
# Reusing open ro fd on device /dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi0-0-0-0-part4
# LUKS2 header version 2 of size 16384 bytes, checksum sha256.
# Checksum:032f92bc... (on-disk)
# Checksum:032f92bc... (in-memory)
# Device size 498213060608, offset 16777216.
# Device /dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi0-0-0-0-part4 READ lock released.
# PBKDF argon2i, time_ms 2000 (iterations 0), max_memory_kb 1048576, parallel_threads 4.
# Activating volume cd1 using token -1.
# Interactive passphrase entry requested.
Enter passphrase for /dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi0-0-0-0-part4:
# Activating volume cd1 [keyslot -1] using passphrase.
# dm version [ opencount flush ] [16384] (*1)
# dm versions [ opencount flush ] [16384] (*1)
# Detected dm-ioctl version 4.43.0.
# Detected dm-crypt version 1.22.0.
# Device-mapper backend running with UDEV support enabled.
# dm status cd1 [ opencount noflush ] [16384] (*1)
# Keyslot 0 priority 1 != 2 (required), skipped.
# Keyslot 1 priority 1 != 2 (required), skipped.
# Keyslot 2 priority 1 != 2 (required), skipped.
# Trying to open LUKS2 keyslot 0.
# Reading keyslot area [0x8000].
# Acquiring read lock for device /dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi0-0-0-0-part4.
# Opening lock resource file /run/cryptsetup/L_8:4
# Verifying lock handle for /dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi0-0-0-0-part4.
# Device /dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi0-0-0-0-part4 READ lock taken.
# Reusing open ro fd on device /dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi0-0-0-0-part4
# Device /dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi0-0-0-0-part4 READ lock released.
# Verifying key from keyslot 0, digest 0.
# Digest 0 (pbkdf2) verify failed with -1.
# Trying to open LUKS2 keyslot 1.
# Reading keyslot area [0x28000].
# Acquiring read lock for device /dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi0-0-0-0-part4.
# Opening lock resource file /run/cryptsetup/L_8:4
# Verifying lock handle for /dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi0-0-0-0-part4.
# Device /dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi0-0-0-0-part4 READ lock taken.
# Reusing open ro fd on device /dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi0-0-0-0-part4
# Device /dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi0-0-0-0-part4 READ lock released.
# Verifying key from keyslot 1, digest 0.
# Digest 0 (pbkdf2) verify failed with -1.
# Trying to open LUKS2 keyslot 2.
# Reading keyslot area [0x48000].
# Acquiring read lock for device /dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi0-0-0-0-part4.
# Opening lock resource file /run/cryptsetup/L_8:4
# Verifying lock handle for /dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi0-0-0-0-part4.
# Device /dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi0-0-0-0-part4 READ lock taken.
# Reusing open ro fd on device /dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi0-0-0-0-part4
# Device /dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi0-0-0-0-part4 READ lock released.
# Verifying key from keyslot 2, digest 0.
# Digest 0 (pbkdf2) verify failed with -1.
No key available with this passphrase.
# Interactive passphrase entry requested.
Enter passphrase for /dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi0-0-0-0-part4: Error reading passphrase from terminal.
# Releasing crypt device /dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi0-0-0-0-part4 context.
# Releasing device-mapper backend.
# Closing read only fd for /dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi0-0-0-0-part4.
# Unlocking memory. maybe helpful, diff on the lsmod
$ diff .19 .20 -y --suppress-common-lines
dm_crypt 57344 1 | dm_crypt 57344 0
dm_mod 159744 3 dm_crypt | dm_mod 159744 1 dm_crypt
aesni_intel 372736 2 | aesni_intel 372736 0
cryptd 24576 3 crypto_simd,ghash_clmulni_int | cryptd 24576 2 crypto_simd,ghash_clmulni_int
> drm_kms_helper 278528 1 drm_vram_helper
> psmouse 184320 0
drm_kms_helper 278528 1 drm_vram_helper <
psmouse 184320 0 <
qemu_fw_cfg 20480 0 <
pcspkr 16384 0 <
mac_hid 16384 0 <
i2c_piix4 28672 0 <
> i2c_piix4 28672 0
> mac_hid 16384 0
> qemu_fw_cfg 20480 0
> pcspkr 16384 0
btrfs 1576960 2 | btrfs 1576960 1
virtio_scsi 24576 2 <
virtio_console 40960 0 <
> virtio_scsi 24576 1
> virtio_console 40960 0
crc32c_intel 24576 3 | crc32c_intel 24576 2
> floppy 90112 0
floppy 90112 0 < Offline
#9 2021-03-06 14:20:10
- ua4000
- Member
- Registered: 2015-10-14
- Posts: 562
Re: [SOLVED] cryptsetup + lts-5.10.20-1 = No key available with this
heftig wrote:
Does this kernel work? https://pkgbuild.com/~heftig/lts2/
thanks, but sorry,
$ uname -a
Linux n8 5.10.20-1.1-lts #1 SMP Sat, 06 Mar 2021 13:24:53 +0000 x86_64 GNU/Linux is not working either.
Offline
#10 2021-03-06 15:09:50
- loqs
- Member
- Registered: 2014-03-06
- Posts: 19,016
Re: [SOLVED] cryptsetup + lts-5.10.20-1 = No key available with this
I can not spot anything from the change log for 5.10.20 or the posted outputs. So I can only suggest bisecting between 5.10.19 and 5.10.20.
Offline
#11 2021-03-06 15:31:03
- Scimmia
- Fellow
- Registered: 2012-09-01
- Posts: 13,729
Re: [SOLVED] cryptsetup + lts-5.10.20-1 = No key available with this
Offline
#12 2021-03-06 16:18:15
- ua4000
- Member
- Registered: 2015-10-14
- Posts: 562
Re: [SOLVED] cryptsetup + lts-5.10.20-1 = No key available with this
Scimmia wrote:
Passphrases over ~64 bytes can't unlock keys with kernel 5.11.3/5.10.20
Thanks Scimmia!!!
Setting up another keyslot with only 60 chars under .19 is now useable under .20.
Offline
#13 2021-03-07 13:56:26
- loqs
- Member
- Registered: 2014-03-06
- Posts: 19,016
Re: [SOLVED] cryptsetup + lts-5.10.20-1 = No key available with this
@ua4000 it should be fixed in linux-lts 5.10.21-1
Offline
#14 2021-03-13 08:47:08
- ua4000
- Member
- Registered: 2015-10-14
- Posts: 562
Re: [SOLVED] cryptsetup + lts-5.10.20-1 = No key available with this
Yes, thanks for the note,
I'm now at 5.10.23-1-lts and it works fine with the original 128 chars password.
Also I made me a hint for my next cryptsetup usecase: a password with 32 chars and good entropy would also be fine :-)
Offline