From 7b2e699dc6ad23e1e1b095659d7a6dcab8bd2649 Mon Sep 17 00:00:00 2001 From: Luca Boccassi Date: Fri, 30 Oct 2026 15:12:37 +0000 Subject: [PATCH] repart: use libcryptsetup to set default kdf params Using pbkdf2 requires setting benchmark parameters, otherwise libcryptsetup 2.7.x rejects the call: Encrypting future partition 4... Allocating context for crypt device /dev/vda5. Trying to open and read device /dev/vda5 with direct-io. Direct-io is supported and works. Initialising device-mapper backend library. Formatting device /dev/vda5 as type LUKS2. Crypto backend (OpenSSL 3.5.7 9 Jun 2026 [default][threads][argon2]) initialized in cryptsetup library version 2.7.5. Detected kernel Linux 6.6.158.1-microsoft-standard aarch64. PBKDF argon2i, time_ms 2000 (iterations 0), max_memory_kb 1048576, parallel_threads 4. Topology: IO (512/0), offset = 0; Required alignment is 1048576 bytes. Checking if cipher aes-xts-plain64 is usable. Using userspace crypto wrapper to access keyslot area. Formatting LUKS2 with JSON metadata area 12288 bytes and keyslots area 16744448 bytes. Creating new digest 0 (pbkdf2). Setting PBKDF2 type key digest 0. Running pbkdf2(sha256) benchmark. PBKDF benchmark: memory cost = 0, iterations = 197397, threads = 0 (took 166 ms) PBKDF benchmark: memory cost = 0, iterations = 200415, threads = 0 (took 654 ms) Benchmark returns pbkdf2(sha256) 200415 iterations, 0 memory, 0 threads (for 512-bits key). Segment 0 assigned to digest 0. Wiping LUKS areas (0x000000 - 0x1000000) with zeroes. Device size 507752448, offset 16777216. Wiping keyslots area (0x008000 - 0x1000000) with random data. Reusing open rw fd on device /dev/vda5 Device size 507752448, offset 16777216. Acquiring write lock for device /dev/vda5. Opening lock resource file /run/cryptsetup/L_253:5 Verifying lock handle for /dev/vda5. Device /dev/vda5 WRITE lock taken. Trying to write LUKS2 header (16384 bytes) at offset 0. Reusing open rw fd on device /dev/vda5 Checksum:78aa194e1f36e1447774b6904438c7e91e4f3fc43bdd7e66eb020ade1e6af1ff (in-memory) Trying to write LUKS2 header (16384 bytes) at offset 16384. Reusing open rw fd on device /dev/vda5 Checksum:6100c4c27eb222056484124f99ce16f26f32ac5f69efff11d2c7ac4f3416944e (in-memory) Device /dev/vda5 WRITE lock released. Failed to set KDF type: Invalid argument Releasing crypt device /dev/vda5 context. Releasing device-mapper backend. Closing read only fd for /dev/vda5. Closing read write fd for /dev/vda5. Failed to encrypt device: Invalid argument Use the crypt_get_pbkdf_type_params() API to set the defaults in the param struct we pass in. Follow-up for fa6eb2e016a53d741ec48a784a8ea075ec3d4fe0 (cherry picked from commit 00d8a9383839ec9a031486da2427bf73e1ef13ca) (cherry picked from commit 37d38a0df00b7904fbf35fcfdcbdbb2910b50666) --- src/repart/repart.c | 19 +++++++++---------- src/shared/cryptsetup-util.c | 2 ++ src/shared/cryptsetup-util.h | 1 + test/units/TEST-58-REPART.sh | 1 + 4 files changed, 13 insertions(+), 10 deletions(-) diff --git a/src/repart/repart.c b/src/repart/repart.c index 7ed706137ee..9e51382f6e3 100644 --- a/src/repart/repart.c +++ b/src/repart/repart.c @@ -5540,17 +5540,16 @@ static int partition_encrypt(Context *context, Partition *p, PartitionTarget *ta * (e.g. kdump with crashkernel=512MB). */ r = cryptsetup_set_minimal_pbkdf(cd); } else { - /* For argon2id or pbkdf2, set the type and let libcryptsetup benchmark - * and determine the parameters. */ - static const struct crypt_pbkdf_type argon2id_pbkdf = { - .type = "argon2id", - }; - static const struct crypt_pbkdf_type pbkdf2_pbkdf = { - .type = "pbkdf2", - }; + assert(IN_SET(p->encrypt_kdf, ENCRYPT_KDF_ARGON2ID, ENCRYPT_KDF_PBKDF2)); - r = sym_crypt_set_pbkdf_type(cd, p->encrypt_kdf == ENCRYPT_KDF_ARGON2ID ? - &argon2id_pbkdf : &pbkdf2_pbkdf); + /* Use libcryptsetup's full defaults, including the benchmark target and hash. */ + const char *kdf = p->encrypt_kdf == ENCRYPT_KDF_ARGON2ID ? CRYPT_KDF_ARGON2ID : CRYPT_KDF_PBKDF2; + const struct crypt_pbkdf_type *pbkdf = sym_crypt_get_pbkdf_type_params(kdf); + if (!pbkdf) + return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), + "Failed to get default parameters for KDF type '%s'.", kdf); + + r = sym_crypt_set_pbkdf_type(cd, pbkdf); } if (r < 0) return log_error_errno(r, "Failed to set KDF type: %m"); diff --git a/src/shared/cryptsetup-util.c b/src/shared/cryptsetup-util.c index 531d2fcbc01..6d430f93e0c 100644 --- a/src/shared/cryptsetup-util.c +++ b/src/shared/cryptsetup-util.c @@ -30,6 +30,7 @@ DLSYM_PROTOTYPE(crypt_get_cipher_mode) = NULL; DLSYM_PROTOTYPE(crypt_get_data_offset) = NULL; DLSYM_PROTOTYPE(crypt_get_device_name) = NULL; DLSYM_PROTOTYPE(crypt_get_dir) = NULL; +DLSYM_PROTOTYPE(crypt_get_pbkdf_type_params) = NULL; DLSYM_PROTOTYPE(crypt_get_type) = NULL; DLSYM_PROTOTYPE(crypt_get_uuid) = NULL; DLSYM_PROTOTYPE(crypt_get_verity_info) = NULL; @@ -299,6 +300,7 @@ int dlopen_cryptsetup(int log_level) { DLSYM_ARG(crypt_get_data_offset), DLSYM_ARG(crypt_get_device_name), DLSYM_ARG(crypt_get_dir), + DLSYM_ARG(crypt_get_pbkdf_type_params), DLSYM_ARG(crypt_get_type), DLSYM_ARG(crypt_get_uuid), DLSYM_ARG(crypt_get_verity_info), diff --git a/src/shared/cryptsetup-util.h b/src/shared/cryptsetup-util.h index 66f6ee18c2e..df0159f3b47 100644 --- a/src/shared/cryptsetup-util.h +++ b/src/shared/cryptsetup-util.h @@ -35,6 +35,7 @@ extern DLSYM_PROTOTYPE(crypt_get_cipher_mode); extern DLSYM_PROTOTYPE(crypt_get_data_offset); extern DLSYM_PROTOTYPE(crypt_get_device_name); extern DLSYM_PROTOTYPE(crypt_get_dir); +extern DLSYM_PROTOTYPE(crypt_get_pbkdf_type_params); extern DLSYM_PROTOTYPE(crypt_get_type); extern DLSYM_PROTOTYPE(crypt_get_uuid); extern DLSYM_PROTOTYPE(crypt_get_verity_info); diff --git a/test/units/TEST-58-REPART.sh b/test/units/TEST-58-REPART.sh index f0773d5bd45..2332322f75f 100755 --- a/test/units/TEST-58-REPART.sh +++ b/test/units/TEST-58-REPART.sh @@ -351,6 +351,7 @@ Label=luks-format-copy UUID=7b93d1f2-595d-4ce3-b0b9-837fbd9e63b0 Format=ext4 Encrypt=yes +EncryptKDF=pbkdf2 CopyFiles=$defs:/def SizeMinBytes=48M VolumeLabel=schrupfel