[dm-crypt] cryptsetup with des or des3

[dm-crypt] cryptsetup with des or des3

[booger@post.pl]

Hello,

 I own the QNAP TS419 PRO NAS device which is basically:

 Linux NAS 2.6.30.6 #1 Tue Apr 27 02:06:10 CST 2010 armv5tel unknown

 It  has dm-crypt support and I am trying to encrypt my external disk,
 connected  by  esata interface. It is visible as /dev/sdy, it has one
 partition, /dev/sdy1.
 
 Unfortunatelly when I do cryptsetup luksFormat I get following error message:

Command failed: Failed to setup dm-crypt key mapping.
Check kernel for support for the aes-cbc-essiv:sha256 cipher spec and verify that /dev/sdy1 contains at least 133 sectors

Below I quote the result of cat /proc/crypto, the aes is not listed. I am ok with other encryption, but when I experiment with --cipher parameter of cryptsetup I still get the same error message. 

Can somebody quote me the right cryptsetup parameters to encypt my external drive?

name         : cbc(des)
driver       : cbc(des-generic)
module       : kernel
priority     : 0
refcnt       : 1
selftest     : passed
type         : givcipher
async        : yes
blocksize    : 8
min keysize  : 8
max keysize  : 8
ivsize       : 8
geniv        : chainiv

name         : cbc(des)
driver       : cbc(des-generic)
module       : kernel
priority     : 0
refcnt       : 1
selftest     : passed
type         : blkcipher
blocksize    : 8
min keysize  : 8
max keysize  : 8
ivsize       : 8
geniv        : <default>

name         : cbc(des3_ede)
driver       : cbc(des3_ede-generic)
module       : kernel
priority     : 0
refcnt       : 1
selftest     : passed
type         : givcipher
async        : yes
blocksize    : 8
min keysize  : 24
max keysize  : 24
ivsize       : 8
geniv        : chainiv

name         : cbc(des3_ede)
driver       : cbc(des3_ede-generic)
module       : kernel
priority     : 0
refcnt       : 1
selftest     : passed
type         : blkcipher
blocksize    : 8
min keysize  : 24
max keysize  : 24
ivsize       : 8
geniv        : <default>

name         : stdrng
driver       : krng
module       : kernel
priority     : 200
refcnt       : 2
selftest     : passed
type         : rng
seedsize     : 0

name         : crc32c
driver       : crc32c-generic
module       : kernel
priority     : 100
refcnt       : 2
selftest     : passed
type         : shash
blocksize    : 1
digestsize   : 4
descsize     : 4

name         : des3_ede
driver       : des3_ede-generic
module       : kernel
priority     : 0
refcnt       : 1
selftest     : passed
type         : cipher
blocksize    : 8
min keysize  : 24
max keysize  : 24

name         : des
driver       : des-generic
module       : kernel
priority     : 0
refcnt       : 1
selftest     : passed
type         : cipher
blocksize    : 8
min keysize  : 8
max keysize  : 8

name         : md5
driver       : md5-generic
module       : kernel
priority     : 0
refcnt       : 1
selftest     : passed
type         : shash
blocksize    : 64
digestsize   : 16
descsize     : 88

Re: [dm-crypt] cryptsetup with des or des3

[Milan Broz]

On 06/12/2010 08:06 PM, booger@post.pl wrote:
> Hello,
>
>   I own the QNAP TS419 PRO NAS device which is basically:
>
>   Linux NAS 2.6.30.6 #1 Tue Apr 27 02:06:10 CST 2010 armv5tel unknown
>
>   It  has dm-crypt support and I am trying to encrypt my external disk,
>   connected  by  esata interface. It is visible as /dev/sdy, it has one
>   partition, /dev/sdy1.
>
>   Unfortunatelly when I do cryptsetup luksFormat I get following error message:


The command fails, because you are trying to use AES, not DES or triple DES.
If there is no aes module (try modprobe aes) and you really want to force use 3DES,
you can - just you have to specify key size also.
(But you cannot use ESSIV here, just plain or benbi type IV mode.)

For DES:
cryptsetup -c des-cbc-plain -s 64 luksFormat <dev>

FOR 3DES:
cryptsetup -c des3_ede-cbc-plain -s 192 luksFormat <dev>

Milan

Re: [dm-crypt] cryptsetup with des or des3

[Arno Wagner]

On Sat, Jun 26, 2010 at 05:29:08PM +0200, Milan Broz wrote:
> On 06/12/2010 08:06 PM, booger@post.pl wrote:
>> Hello,
>>
>>   I own the QNAP TS419 PRO NAS device which is basically:
>>
>>   Linux NAS 2.6.30.6 #1 Tue Apr 27 02:06:10 CST 2010 armv5tel unknown
>>
>>   It  has dm-crypt support and I am trying to encrypt my external disk,
>>   connected  by  esata interface. It is visible as /dev/sdy, it has one
>>   partition, /dev/sdy1.
>>
>>   Unfortunatelly when I do cryptsetup luksFormat I get following error message:
>
>
> The command fails, because you are trying to use AES, not DES or triple DES.
> If there is no aes module (try modprobe aes) and you really want to force use 3DES,
> you can - just you have to specify key size also.
> (But you cannot use ESSIV here, just plain or benbi type IV mode.)
>
> For DES:
> cryptsetup -c des-cbc-plain -s 64 luksFormat <dev>
>
> FOR 3DES:
> cryptsetup -c des3_ede-cbc-plain -s 192 luksFormat <dev>
>
> Milan

Be aware that on practically all hardware, DES and 
especially 3DES is significantly slower than AES. Also
DES can be regarded as broken in practice, not only 
in the academic sense. Do not use DES/3DES unless you 
have a very good reason and do not mind running an
insecure system.

Arno
-- 
Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email: arno@wagner.name 
GnuPG:  ID: 1E25338F  FP: 0C30 5782 9D93 F785 E79C  0296 797F 6B50 1E25 338F
----
Cuddly UI's are the manifestation of wishful thinking. -- Dylan Evans

If it's in the news, don't worry about it.  The very definition of 
"news" is "something that hardly ever happens." -- Bruce Schneier