Check that kernel supports aes-xts-plain64 cipher

Question

After an update I can't access my encrypted disk.

When trying to do so :

sudo cryptsetup luksOpen /dev/sda8 Documents


Failed to setup dm-crypt key mapping
Check that kernel supports aes-xts-plain64 cipher (check syslog for more info)

I did:

lsmod | grep -i aes
aesni_intel           167997  3
aes_x86_64             16719  1 aesni_intel
lrw                    12757  1 aesni_intel
glue_helper            12649  1 aesni_intel
ablk_helper            12572  1 aesni_intel
cryptd                 18553  2 aesni_intel,ablk_helper

Also:

lsmod | grep -i dm-mod
lsmod | grep -i dm-crypt
lsmod | grep -i sha256
lsmod | grep -i xts 

and they didn't return anything,so,I modprobe all of these but I have still the same issue.

Answer 1

According to man cryptsetup :

The available combinations of ciphers, modes, hashes and key sizes depend on kernel support. See /proc/crypto for a list of available options. You might need to load additional kernel crypto modules in order to get more options.

Also try cryptsetup --help to show defaults.

---

FYI: My (Linux Mint) cryptsetup works fine with default LUKS. My cryptsetup --help has this at the end:

Default compiled-in device cipher parameters:
    loop-AES: aes, Key 256 bits
    plain: aes-cbc-essiv:sha256, Key: 256 bits, Password hashing: ripemd160
    LUKS1: aes-xts-plain64, Key: 256 bits, LUKS header hashing: sha1, RNG: /dev/urandom

And my lsmod contains no mention of sha, aes, or xts, but does have:

dm_crypt 22653 0 (note the underscore, not a dash like in your Q)

And my /proc/crypto has:

$ grep name.*aes /proc/crypto|cut -d : -f 2
 cbc(aes)
 aes