Re: Problem after converting to LUKS2

On 11/16/23 14:22, Anton Avramov wrote:
> 
> On 2023-11-16 02:56, Milan Broz wrote:
>> On 11/15/23 16:34, Anton Avramov wrote:
>> ...
>>>> Please post log from failing command (luksOpen?) with --debug option,
>>>> so we can see what
>>>> is failing and what exact version (toolss, kernel) you are using.
>>> Ubuntu 22.04.3 LTS
>>>
>>> Linux  5.15.0-88-generic #98-Ubuntu SMP Mon Oct 2 15:18:56 UTC 2023
>>> x86_64 x86_64 x86_64 GNU/Linux
>>>
>>> # cryptsetup 2.4.3 processing "cryptsetup luksOpen --key-file
>>> /root/.luks/.p2pool.keyfile /dev/sda1 CryptP2Pool --debug"
>>
>> ...
>>
>> That log looks like a correct processing in open (with an incorrect
>> keyfile).
>> (Or the convert process really corrupted something in keyslot...)
> That key was used for years and I've checked several times in
> /etc/crypttab that this is the correct one.
>>
>> Could you please send luksDump (ans ideally also luksDump
>> --dump-json-metadata)
>> output to check how it is exactly configured?
> I'm attaching both.

Thanks.

The dump is pretty standard LUKS1 converted to LUKS2, the only change to default
key size as AES-128 is used (--key-size 256 with XTS mode).

If I recreate the same setup with cryptsetup 2.6.1, both used keyslots work after
conversion (both ways luks1<->luks2), so no idea what went wrong...

note, the key digest is sha256 but only 20 bytes are stored (as LUKS1 has fixed
20bytes space), but this is expected and code supports this, exactly
because of LUKS1 conversion (it is not a security issue here).

If you have working drives converted the same way - could you please check luksDump
what is different here (except salt and iteration count)?

Milan