Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I try to mount an encrypted HFS+ partition in Ubuntu.

An older post described quite good how to do it, but lacks the information how to use encrypted partitions.

What I found so far is:

  # install required packages
  sudo apt-get install hfsprogs hfsutils hfsplus loop-aes-utils
  # try to mount it
  mount -t hfsplus -o encryption=aes-256 /dev/xyz /mount/xyz

But once I run this I get the following error:

  Error: Password must be at least 20 characters.

So I tried to type it in twice, but that results in this:

  ioctl: LOOP_SET_STATUS: Invalid argument, requested cipher or key (256 bits) not supported by kernel

Any suggestions?

share|improve this question
    
Not sure if this makes a difference, but have you tried aes256 instead of aes-256? –  Ansgar Wiechers Sep 21 '12 at 19:56
    
yes - same result for both - even just using "aes" gives the same result –  pagid Sep 21 '12 at 20:01

2 Answers 2

up vote 27 down vote accepted

You can't mount an HFS+ partition encrypted in OS X using mount's option encryption=aes. The reason is that encrypted HFS+ partitions and volumes use a proprietary format.

Neither Cryptoloop nor Loop-AES, which are the underlying decryption methods used by mount and encryption, understand that format.

This is what I found out:

Cryptoloop can mount partitions or disk images encrypted as a single AES block (this is called single-key mode, see http://www.tldp.org/HOWTO/html_single/Cryptoloop-HOWTO/#cryptoloop-introduction):

  /dev/sdXX                                                        
  disk image                                                       /dev/loopX
+-----------+                                                    +-------------+
|           |                                                    |             |
|           |                                                    |             |
|           |                                                    | unencrypted |
| AES block | -AES passwd->AES key->decrypt I/O to loop device-> |  partition  |
|           |                                                    |             |
|           |                                                    |             |
|           |                                                    |             |
+-----------+                                                    +-------------+

AES-Loop can mount single-key (like above) and multi-key encrypted partitions or disk images:

  /dev/sdXX                                                        
  disk image                                                         /dev/loopX
+------------+                                                    +-------------+
|AES block #1|                                                    |             |
+------------+                                                    |             |
|AES block #2|                                                    | unencrypted |
+------------+ -AES passwd->AES key(s)->decrypt I/O to loop dev-> |  partition  |
|AES block #3|                                                    |             |
+------------+                                                    |             |
|    ...     |                                                    |             |
+------------+                                                    +-------------+

On the other hand, an encrypted HFS+ partition:

Cryptoloop's successor, dm-crypt, can't read encrypted HFS+ either.

But before all hope is gone:

As for the error messages you encountered:

First error:

Error: Password must be at least 20 characters.

Surprisingly, mount enforces long passwords not only for encryption but also for decryption, although you may not have control over the partition to decrypt. You can only get around this nuisance by downloading and editing the source and recompiling. (Other distributions, like SuSE Linux Enterprise Server (SLES), don't have this restriction.)

Second error:

ioctl: LOOP_SET_STATUS: Invalid argument, requested cipher or key (256 bits) not supported by kernel

You need to load the Cryptoloop kernel module:

$ sudo modprobe cryptoloop

because although you installed package loop-aes-utils you are not using Loop-AES.

Loop-AES uses several modified user space tools (mount, umount, losetup, swapon and swapoff, provided by loop-aes-utils) and a modified loop.ko kernel module. Recent Ubuntu versions compile an unmodified loop module into the kernel:

    $ cd /usr/src/linux-source-3.2.0/linux-source-3.2.0/drivers/block/
    $ diff -q /tmp/loop.c-3.x.patched loop.c
    Files /tmp/loop.c-3.x.patched and loop.c differ

so Loop-AES can't be used on Ubuntu out of the box. You need to patch and recompile the kernel as explained here: http://loop-aes.sourceforge.net/loop-AES.README. That's why mount still needs Cryptoloop.

If you still get a similar error message after loading cryptoloop.ko the encryption type may be not recognized. For example, my Ubuntu 12.04 didn't recognize aes-128, but aes. SLES only recognizes aes-128.

share|improve this answer
    
+1 for the in-depth information and detail provided in the answer. –  Daemon of Chaos Nov 5 '12 at 18:42
    
Wow -Thank you!!! –  pagid Nov 8 '12 at 10:00
    
You're welcome! –  jaume Nov 8 '12 at 10:08
2  
This is a simply phenomenal answer. Exceptionally informative, detailed, and apparently extremely well researched. Thanks for sharing jaume, thanks a lot. –  chmac Apr 17 '13 at 13:30
    
Thanks! I'm glad you found it useful. –  jaume Apr 17 '13 at 14:19

Actually, there is Java application hfsexplorer that is able to open encrypted .dmg files and creates decrypted .dmg images which can be mounted in Linux.

I was able to create encrypted .dmg files in OS X 10.9.5 and then explore the image from a virtual machine running Ubuntu 14.04.2 LTS. Both AES-128 and AES-256 encryption worked for my test cases.

This is how I created the .dmg image:

$ hdiutil create -size 10m -layout NONE -fs HFS+ -encryption AES-256 -volname "Vault" vault.dmg

From the virtual machine running Ubuntu I was able to open the image:

$ ./hfsexplorer-0/bin/hfsexplorer.sh /tmp/vault.dmg

It prompts for a password and then shows the content of the image. There is an option (Tools -> create disk image) which creates an decrypted disk image which can then be mounted with the hfs tools from linux.

$ mount vault_decrypted.dmg /mnt/hfs/

Even HFS+ Journaled file systems worked. The only limitation is that the write support to HFS+J file systems is disabled by default in Linux.

This demonstrates that the encryption of .dmg is understood by hfsexplorer and could possibly be implemented in the mount command. With creating an unencrypted .dmg it is possible to mount the image in Linux ultimately.

vfdecrypt did not work for me either.

share|improve this answer
    
Interesting, thank you for your response. –  Jeff Burdges Apr 3 at 21:41

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.