1

I have an external HDD connected with my Pi 3 running Raspbian Jessie which I had encrypted with LUKS using the cipher twofish-xts-plain. But after upgrading to Raspbian Strech running Linux kernel 4.9.28-v7+, I could no longer unlock and mount the drive. When I call cryptsetup luksOpen /dev/sdb luksdrive, I get the following error

device-mapper: reload ioctl on  failed: No such file or directory
Failed to setup dm-crypt key mapping for device /dev/sdb.
Check that kernel supports twofish-xts-plain cipher (check syslog for more info).

On further investigation, I noticed that there are no twofish modules under the directory /lib/modules/4.9.28-v7+ by calling find /lib/modules/ -iname '*twofish*' with the following result:

/lib/modules/4.9.0-2-rpi2/kernel/crypto/twofish_common.ko
/lib/modules/4.9.0-2-rpi2/kernel/crypto/twofish_generic.ko
/lib/modules/4.4.0-1-rpi2/kernel/crypto/twofish_common.ko
/lib/modules/4.4.0-1-rpi2/kernel/crypto/twofish_generic.ko

On the other hand, calling find /lib/modules/ -iname '*aes*' does bring up this entry: /lib/modules/4.9.28+/kernel/arch/arm/crypto/aes-arm.ko

Is this an isolated problem or has twofish indeed been removed from the kernel? In case it's the latter, is there anyway to "install" a separate twofish module?

2

This is quite simple. The official Raspbian Kernel was built with most crypto algorithms disabled, including twofish.

Only algorithms required as dependencies by other kernel drivers like IPSec are included, which is why AES and 3DES are still available.

I find this decision very annoying too, especially considering that the crypto modules are only very small and would have only neglectible effect on disk space usage.

However, it is possible to build the missing kernel modules oneself, and load them via insmod into the official Raspbian kernel.

I did this once, but it is not for the faint of heart, and not something one wants to do on a regular basis.

My guess would be that the NSA, GHCQ & friends want all the world to use AES only, and somehow managed to persuade the guys configuring the Raspbian kernel accordingly.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.