Re: [dm-crypt] Newbie question --key-file

[Milan Broz <gmazyland@gmail.com>]

On 10/26/2012 06:27 PM, Li, David wrote:
> Hi Dennis,
> Please see below.
> 
>>> First I did:
>>> /-bash-4.1# cryptsetup --key-file keyfile-1 luksFormat /dev/loop0/
>> ...
>>
>> for me your example works but I have sha256, aes and cbc loaded (which is
>> required as you use aes as crypto-mode, sha256 as hash and cbc as block-mode
>> or what ever it is called). The setup is not proper as you see there is no key slot
>> used.
> 
> 
> [Li, David] Can you explain a little here why key slot wasn't used?
> Why did the luksDump or the blkid result seem to be normal? 

I think there are just missing internal kernel modules.

Cryptsetup internally first generates master key, then writes visible header and then
enables keyslot - and for keyslot write it requires kernel crypto modules.
If last step fails, you end up with LUKS header without any slot enabled.

(The error reporting here is not optimal, still thinking how to get
exact infmation from kernel.
Anyway there is:
"Check that kernel supports aes-cbc-essiv:sha256 cipher (check syslog for more info)."

Did you check syslog?

According to /proc/crypto, you have no aes module, no cbc, no sha256...

Milan