[dm-crypt] Question regarding Cryptosetup

[dm-crypt] Question regarding Cryptosetup

[Petar Zdravkov]

[-- Attachment #1: Type: text/plain, Size: 1069 bytes --]

Hello,

I am writing to you regarding the cryptosetup tool, and more specifically
the luks2tpm branch. I am a student and I have been playing around with
RPi + TPM (
https://www.infineon.com/dgdl/Infineon-App-Note-SLx9670-TPM2.0_Embedded_RPi_DI_SLx-AN-v01_20-EN.pdf?fileId=5546d46267c74c9a01684b96e69f5d7b&redirId=58958)
and I have been following the steps to install the library as pointed in
the guide above, written by the TPM manufacturer. Detailed
information about the cryptosetup installation can be found in section
5.6.1.

My question to you is regarding an error I have encountered while trying to
use the following command:

*cryptsetup luksFormat --type=luks2 --tpm --tpm-bank=sha1,sha256
luks2tpm.img*

what I get as an error message is:
*relocation error: cryptsetup: symbol crypt_keyslot_tpm_add_by_key version
CRYPTSETUP_2.0 not defined in file libcryptsetup.so.12 with link time
reference*

I did not manage to find any information about this issue online, so I hope
you could help me out with it.

Thank you very much in advance.

Best regards,
Petar

[-- Attachment #2: Type: text/html, Size: 1491 bytes --]

Re: [dm-crypt] Question regarding Cryptosetup

[Michael Kjörling]

On 4 Nov 2019 01:07 +0000, from p.zdravkov1617@gmail.com (Petar Zdravkov):
> what I get as an error message is:
> *relocation error: cryptsetup: symbol crypt_keyslot_tpm_add_by_key version
> CRYPTSETUP_2.0 not defined in file libcryptsetup.so.12 with link time
> reference*

I'm guessing that your version of the cryptsetup executable does not
match the libcryptsetup shared library.

You can check what shared libraries the dynamic linker wants to load
by doing `type cryptsetup` to get the path to the cryptsetup binary
that the shell launches, then `ldd /path/to/cryptsetup` to see what
shared libraries the dynamic linker wants to load for it. (`ldd` needs
the full path to the executable, so you can't just do something like
`ldd cryptsetup`.)

-- 
Michael Kjörling • https://michael.kjorling.se • michael@kjorling.se
  “The most dangerous thought that you can have as a creative person
              is to think you know what you’re doing.” (Bret Victor)

Re: [dm-crypt] Question regarding Cryptosetup

[Milan Broz]

On 04/11/2019 10:58, Michael Kjörling wrote:
> On 4 Nov 2019 01:07 +0000, from p.zdravkov1617@gmail.com (Petar Zdravkov):
>> what I get as an error message is:
>> *relocation error: cryptsetup: symbol crypt_keyslot_tpm_add_by_key version
>> CRYPTSETUP_2.0 not defined in file libcryptsetup.so.12 with link time
>> reference*
> 
> I'm guessing that your version of the cryptsetup executable does not
> match the libcryptsetup shared library.

Yes, but note that Infineon build will be never compatible with upstream cryptsetup.

There is proof-of-concept branch in cryptsetup upstream (wip-tokens) where
I tried to propose solution for TPM support.

What are you trying to achieve with TPM? Just playing, or you have some
specific project?

I have another student that should work on this (in upstream), so maybe
I can provide you more info (just later) if you are interested to play with TPM.

Milan