From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <gmazyland@gmail.com>
Received: from mail-la0-x235.google.com (mail-la0-x235.google.com
 [IPv6:2a00:1450:4010:c03::235])
 (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits))
 (No client certificate requested)
 by mail.server123.net (Postfix) with ESMTPS
 for <dm-crypt@saout.de>; Fri,  5 Sep 2014 17:29:31 +0200 (CEST)
Received: by mail-la0-f53.google.com with SMTP id q1so5532334lam.12
 for <dm-crypt@saout.de>; Fri, 05 Sep 2014 08:29:30 -0700 (PDT)
Message-ID: <5409D6D6.5050305@gmail.com>
Date: Fri, 05 Sep 2014 17:29:26 +0200
From: Milan Broz <gmazyland@gmail.com>
MIME-Version: 1.0
References: <27d5e048ef3f17501e9e92019b4c7643.squirrel@ssl.verfeiert.org>
 <5404D045.5020002@gmail.com>
 <8eb220aa5096641f9144b1128d117ed4.squirrel@ssl.verfeiert.org>
 <5404DA01.2050507@gmail.com>
 <57348c6a4168767613f999ddabe9a54f.squirrel@ssl.verfeiert.org>
 <5407482C.1060902@gmail.com>
 <3ff26a70ae9179ea3c37012459998cf4.squirrel@ssl.verfeiert.org>
 <54081391.6000003@gmail.com>
 <6899887c4cbe94228dea5619a57f64aa.squirrel@ssl.verfeiert.org>
In-Reply-To: <6899887c4cbe94228dea5619a57f64aa.squirrel@ssl.verfeiert.org>
Content-Type: text/plain; charset=windows-1252
Content-Transfer-Encoding: 7bit
Subject: Re: [dm-crypt] cryptsetup upgrade to 1.6.x unlocking problem in
	initramfs
List-Id: <dm-crypt.saout.de>
List-Unsubscribe: <http://www.saout.de/mailman/options/dm-crypt>,
 <mailto:dm-crypt-request@saout.de?subject=unsubscribe>
List-Archive: <http://www.saout.de/pipermail/dm-crypt/>
List-Post: <mailto:dm-crypt@saout.de>
List-Help: <mailto:dm-crypt-request@saout.de?subject=help>
List-Subscribe: <http://www.saout.de/mailman/listinfo/dm-crypt>,
 <mailto:dm-crypt-request@saout.de?subject=subscribe>
To: sven@whgl.uni-frankfurt.de, dm-crypt@saout.de

On 09/05/2014 12:54 AM, Sven Eschenberg wrote:
> For me two major questions remain though:
> 1.) Why did an older version of cryptsetup work without these modules?

Hi,

HMAC is mandatory, so check your previous config... I guess just some magic
switched it to module... :)

> 2.) Why is HMAC needed? It is not obvious and if some other kernel module
> needs it, why is the dependecy missing?

It is not dependence for kernel module but requirement of PBKDF2 used in LUKS.

But as I said, it should report problems in more clear error messages...

> 4.) if HMAC dependecy is owed to cryptsetup specificly, is that documented
> already?

I do not think there is a list of required kernel modules. Perhaps it should
be added somewhere. But I am afraid exact list will depend on kernel versions and
other configuration (crypto mgr, fips, hw accel. support, ...)

In short, for kernel backend, AF_ALG must be supported in general.

Then for LUKS: generic hash support, specific hash used in LUKS and HMAC is required.
With 1.6.5 and later it will optionally utilize also skcipher interface (so you need
the block cipher and block mode used in LUKS header.

For TrueCrypt support you need the same, (hash, hmac, block cipher, block mode).

Perhaps man page or FAQ could be more descriptive here (... send a patch ;-)

Thanks,
Milan