1

I've got a very old USB disk, on which there's a very old encrypted partition.

It mounts as /dev/sdb1

On a newish box (with cryptsetup 1.7.3), I can attach to it with:

cryptsetup -c aes-plain -s 128 -h sha256 create wdexternal /dev/sdb1

But on an older box with (cryptsetup 1.6.1), that results in a /dev/mapper/wdexternal that doesn't look like a filesystem (according to fsck)

I've also tried the old command:

cryptsetup open /dev/sdb1 wdexternal

which my notes tell me used to work back in the day, but that gives

Device /dev/sdb1 is not a valid LUKS device.

Anyone know what's going on/how to fix it/how to go about understanding the problem?

Improve this question

1 Answer 1

Reset to default
2

LUKS is just one of several encryption methods that cryptsetup supports.

cryptsetup create is for plain, non-LUKS encrypted devices. As such, there is no LUKS header, no metadata, no specification of ciphers, no key derivation / bruteforce protection.

Without a metadata header, cryptsetup can't figure out which encryption mode to use. Hence you more or less have to use the full command that specifies all ciphers involved manually. Other commands might have worked in the past (I can't verify right now), but in general with plain mode, if you don't specify everything on the command line, you rely on default choices and defaults change over time, so it's not reliable.

The main issue with not using LUKS (with default settings) is that it's easy to pick the wrong cipher. Consider backing up and re-encrypting this data - with LUKS, if you want the simple open command to work.

Improve this answer

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.