[regression]: cryptsetup with luks2 and serpent-xts-plain64 is broken

When i try to create an encrypt file with luks2 and serpent-xts-plain64:

cryptsetup --type luks2 --pbkdf argon2id --cipher serpent-xts-plain64 --key-size 512 --hash sha512 --use-random --verify-passphrase luksFormat disk.img

I get the error: Cannot use serpent-xts-plain64 cipher for keyslot encryption.

Doing the same with luks2 and aes-xts-plain64 works:

cryptsetup --type luks2 --pbkdf argon2id --cipher aes-xts-plain64 --key-size 512 --hash sha512 --use-random --verify-passphrase luksFormat disk.img

This seems to be a bug and should get fixed.

BTW doing the same with luks1 and serpent-xts-plain64 works:

cryptsetup --type luks1 --cipher serpent-xts-plain64 --key-size 512 --hash sha512 --use-random --verify-passphrase luksFormat disk.img

changed the description

changed the description

I cannot reproduce it here. Can you truy it with the last stable version (2.2.2)?

Could you please paste debug output - just add --debug option to the failing command. This will report also all versions we need to reproduce it. Thanks.

debug output was included this line:

Userspace crypto wrapper cannot use serpent-xts-plain64 (-95).

I found out i need to enable CONFIG_CRYPTO_USER_API_SKCIPHER in the kernel which fixed the problem, now it works.

Do you have serpent cipher enabled in kernel crypto? (grep SERPENT /your/kernel/config). LUKS2 requires keyslot encryption cipher enabled in kernel crypto.

Yes, otherwise luks1 with serprent wouldn't have worked but CONFIG_CRYPTO_USER_API_SKCIPHER was missing, now it works.

closed