[dm-crypt] cryptsetup-1.6.3/truecrypt container

[dm-crypt] cryptsetup-1.6.3/truecrypt container

[Michael Strauss]

Hello,

can someone please enlighten me? I try to mount a truecrypt volume with
cryptsetup-1.6.3 and get the error message:

cryptsetup -v --type tcrypt open /tmp/testconti.tc test
Enter passphrase: 
Required kernel crypto interface not available.
Ensure you have algif_skcipher kernel module loaded.
Command successful.

But it's there:

lsmod:

[...]
algif_skcipher
[...]

After mounting the fs it works, but why the error message?

Bye,
	Michael

Re: [dm-crypt] cryptsetup-1.6.3/truecrypt container

[Milan Broz]

On 12/28/2013 05:43 AM, Michael Strauss wrote:
> can someone please enlighten me? I try to mount a truecrypt volume with
> cryptsetup-1.6.3 and get the error message:
> 
> cryptsetup -v --type tcrypt open /tmp/testconti.tc test
> Enter passphrase: 
> Required kernel crypto interface not available.
> Ensure you have algif_skcipher kernel module loaded.
> Command successful.

Hi,

seems like a bug in kernel crypto API detection.

Could you please send me output of the cryptsetup command above
with added --debug switch?
(Or create new issue on the project page and attach log there.)

Thanks,
Milan

Re: [dm-crypt] cryptsetup-1.6.3/truecrypt container

[Milan Broz]

On 12/28/2013 05:43 AM, Michael Strauss wrote:
> Hello,
> 
> can someone please enlighten me? I try to mount a truecrypt volume with
> cryptsetup-1.6.3 and get the error message:
> 
> cryptsetup -v --type tcrypt open /tmp/testconti.tc test
> Enter passphrase: 
> Required kernel crypto interface not available.
> Ensure you have algif_skcipher kernel module loaded.
> Command successful.
> 
> But it's there:
> 
> lsmod:
> 
> [...]
> algif_skcipher
> [...]
> 
> After mounting the fs it works, but why the error message?

Fixed in
http://code.google.com/p/cryptsetup/source/detail?r=8dc48776979c67cdbf4991510ead4d716f34db03

For now you can safely ignore this warning message :)

(This message is just try to help if command completely fails but it is sometimes
problematic to detect if it is missing required kernel interface or intentional kernel
module not-compiled-in system hardening...)

Thanks for reporting it,
Milan

Re: [dm-crypt] cryptsetup-1.6.3/truecrypt container

[Michael Strauss]

Hello Milan...

Milan Broz writes:

> Fixed in
>
http://code.google.com/p/cryptsetup/source/detail?r=8dc48776979c67cdbf4991510ead4d716f34db03

I grabed a copy and tested it. Nearly solved. Thank you. Now it works if I
enter the correct password with the first try, but if I use it with
"--tries" it complains again if the first password is wrong.

cryptsetup -v --tries 3 --type tcrypt open /tmp/testconti.tc test
Enter passphrase: [wrong password]
Required kernel crypto interface not available.
Ensure you have algif_skcipher kernel module loaded.
Command failed with code 2: Ensure you have algif_skcipher kernel module loaded.

Bye,

    Michael

Re: [dm-crypt] cryptsetup-1.6.3/truecrypt container

[Milan Broz]

On 12/29/2013 05:14 PM, Michael Strauss wrote:
> Hello Milan...
> 
> Milan Broz writes:
> 
>> Fixed in
>>
> http://code.google.com/p/cryptsetup/source/detail?r=8dc48776979c67cdbf4991510ead4d716f34db03
> 
> I grabed a copy and tested it. Nearly solved. Thank you. Now it works if I
> enter the correct password with the first try, but if I use it with
> "--tries" it complains again if the first password is wrong.

I hope now it is fixed completely :) please check git version...

Thanks,
Milan

Re: [dm-crypt] cryptsetup-1.6.3/truecrypt container

[Michael Strauss]

Hello Milan...

Milan Broz writes:

> I hope now it is fixed completely :) please check git version...

Not completely I fear. :-) The error message with "algif_skcipher" is gone,
but "--tries"
seems to have no effect if enter a wrong password at my first try. As I
understand it, cryptsetup 
should give me 2 more chances of entering the right PW before quitting?

Styx:/tmp # cryptsetup -v --tries 3 --type tcrypt open /tmp/testconti.tc test
Enter passphrase: [wrong password]
No device header detected with this passphrase.
Command failed with code 1: No device header detected with this passphrase.
Styx:/tmp #

Bye,
   Michael

Re: [dm-crypt] cryptsetup-1.6.3/truecrypt container

[Milan Broz]

On 01/01/2014 10:47 PM, Michael Strauss wrote:
> Hello Milan...
> 
> Milan Broz writes:
> 
>> I hope now it is fixed completely :) please check git version...
> 
> Not completely I fear. :-) The error message with "algif_skcipher" is gone,
> but "--tries"
> seems to have no effect if enter a wrong password at my first try. As I
> understand it, cryptsetup 
> should give me 2 more chances of entering the right PW before quitting?

Ah so, I thought you mean just the error message.

Yes, --tries doesn't work there (in fact it never worked for truecrypt format).
It will need some small code changes but it should work...
I will implement this later.

Milan

Re: [dm-crypt] cryptsetup-1.6.3/truecrypt container

[Michael Strauss]

Hello Milan

Milan Broz writes:

> Ah so, I thought you mean just the error message.

Both of it but good that at least the error messages have 
gone away now. A better feeling and less fear that you 
possibly could lose data because of this.
 
> Yes, --tries doesn't work there (in fact it never worked for 
> truecrypt format).
> It will need some small code changes but it should work...
> I will implement this later.

Ok, no problem. :-) But IMHO that should be mentioned in the man 
page until it's done.

Bye,
Michael

Re: [dm-crypt] cryptsetup-1.6.3/truecrypt container

[Milan Broz]

On 01/02/2014 07:02 PM, Michael Strauss wrote:
>> Yes, --tries doesn't work there (in fact it never worked for 
>> truecrypt format).
>> It will need some small code changes but it should work...

It is implemented now in git tree, both open and dump cryptsetup
commands should support --tries option now.

Milan

Re: [dm-crypt] cryptsetup-1.6.3/truecrypt container

[Michael Strauss]

Hello Milan...

Milan Broz writes:

> It is implemented now in git tree, both open and dump cryptsetup
> commands should support --tries option now.

I tested it and both work as expected. Good job. :-) Thank you.

Michael