Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

After entering the correct passphrase at the command ecryptfs-mount-private, I am getting this error:

torben@torben-nettop:~$ sudo ecryptfs-recover-private
INFO: Searching for encrypted private directories (this might take a while)...
INFO: Found [/media/0f417b42-11a0-4539-9cae-e11ce3b289c3/home/.ecryptfs/
  torben/.Private].
Try to recover this directory? [Y/n]: y
INFO: Enter your LOGIN passphrase...
Passphrase: 
Error: Unwrapping passphrase and inserting into the user session keyring
  failed [-5]
Info: Check the system log for more information from libecryptfs
torben@torben-nettop:~$ 

Syslog has this information:

ecryptfs-insert-wrapped-passphrase-into-keyring:  
  Incorrect wrapping key for file [/home/torben/.ecryptfs/wrapped-passphrase]  
ecryptfs-insert-wrapped-passphrase-into-keyring: Error attempting to unwrap
  passphrase from file [/home/torben/.ecryptfs/wrapped-passphrase]; rc = [-5]

--> Given that I am absolutely sure that I am entering the correct passphrase, what can I do to fix this problem so that I can read the encrypted home folder?

Some background:

  • I have installed Ubuntu 11.04 on a new drive and I want to copy my home folder from the old drive, which is encrypted (I have the passphrase).
  • With the help of Marco Ceppi in the chat, I followed these precise steps yesterday and successfully gained access to the encrypted home folder. This proves that my passphrase does indeed work.
  • I then started the machine on copying from the old encrypted home folder to the new unencrypted home folder and went to bed. When I returned to the computer, I saw that it had suspended itself :( and had not finished copying the folder.
  • I rebooted the computer, and removed the temporary /recovery folders, then followed the exact same steps again, but this is when I encountered the error given above. I tried this several times; always the same result. I am absolutely sure that I am typing the passphrase correct.
share|improve this question
    
I'm not familiar with this area - hence the comment not an answer - have you tried the steps by "1awsomeguy" in this linked post? ubuntuforums.org/archive/index.php/t-1471961.html –  fossfreedom Sep 11 '11 at 13:55
    
That forum post refers to instructions that are no longer valid. The instruction webpage clearly states to use a newer tool instead, which is what I tried to use in the question above. The only difference is that I'm not booting off a USB "LiveCD" but running it locally, because the encrypted folder in question is not local but on an external disk. –  Torben Gundtofte-Bruun Sep 12 '11 at 19:59
    
Possibly a fast way - have you tried contacting the ecryptfs developer directly? Here are his contacts: launchpad.net/~kirkland He seems friendly. Sending him the link to this question may get him curious as it is very specific and still unanswered. –  Strapakowsky Sep 16 '11 at 5:09
    
@strapa - good idea! I did send a question on Launchpad but omitted this webpage. That might work! –  Torben Gundtofte-Bruun Sep 16 '11 at 6:55
    
Apparently nobody knows what this error message means ... what a fruitless waste of my rep! :'-( –  Torben Gundtofte-Bruun Sep 18 '11 at 18:05

2 Answers 2

up vote 4 down vote accepted

I was recently getting the a similar error, when trying to decrypt some data from an external drive. Every time the error message was from an invalid password, I can duplicate this all day long. Instead using ecryptfs-recover-private I was using ecryptfs-unwrap-passphrase, which I think is for specific data, though I don't feel like looking up the difference.

My steps after mounting the old drive...

cd /media/06290978-9723-4b0f-b521-a5386fd17aa1/.ecryptfs/paulj/.encryptfs
ecryptfs-unwrap-passphrase ./wrapped-passphrase
Passphrase:

It will always prompt for a passphrase, this is the password initially setup when you created the encrypted home directory when you installed Ubuntu. In the setup it highly recommends that you use a different password than your login password... if you've been trying your login password for the last hour and failing, try some different ones .. try that one password which you rarely use.

I had forgotten what mine was, I tried all of my super awesome passwords, and I kept getting this error message:

Error: Unwrapping passphrase failed [-5]
Info: Check the system log for more information from libecryptfs

After searching google for about an hour, I figured I'd try a password I knew was bad, so I put in password at the Passphrase prompt.

The following was spit out:

116b053e08564b53b2967e64e509bdc5

I reran ecryptfs-unwrap-passphrase and tried a different password and received the same -5 error message as listed above. It turns out that I had actually set the passphrase to password, probably due to my frustrations with decrypting data in ubuntu in the past.

Adding the passphrase to ecryptfs-add-passphrase...

sudo ecryptfs-add-passphrase --fnek
Passphrase: 116b053e08564b53b2967e64e509bdc5

Outputs:

Inserted auth tok with sig [b69fed2a22932ba4] into the user session keyring
Inserted auth tok with sig [8aad0fb4482edab3] into the user session keyring

Mounting the drive:

sudo mkdir -p /home/paulj/Private
sudo mount -t ecryptfs /media/06290978-9723-4b0f-b521-a5386fd17aa1/.ecryptfs/paulj/.Private /home/paulj/Private

Passphrase: 116b053e08564b53b2967e64e509bdc5
Select cipher: 
 1) aes: blocksize = 16; min keysize = 16; max keysize = 32 (loaded)
 2) blowfish: blocksize = 16; min keysize = 16; max keysize = 56 (not loaded)
 3) des3_ede: blocksize = 8; min keysize = 24; max keysize = 24 (not loaded)
 4) cast6: blocksize = 16; min keysize = 16; max keysize = 32 (not loaded)
 5) cast5: blocksize = 8; min keysize = 5; max keysize = 16 (not loaded)
Selection [aes]: aes

Select key bytes: 
 1) 16
 2) 32
 3) 24
Selection [16]: 16

Enable plaintext passthrough (y/n) [n]: n

Enable filename encryption (y/n) [n]: y

{this is the second value from Inserted auth tok...}
Filename Encryption Key (FNEK) Signature: 8aad0fb4482edab3

Attempting to mount with the following options:
  ecryptfs_unlink_sigs
  ecryptfs_fnek_sig=8aad0fb4482edab3
  ecryptfs_key_bytes=16
  ecryptfs_cipher=aes
  ecryptfs_sig=b69fed2a22932ba4
Mounted eCryptfs

Hopefully when you initially created the encrypted drive you didn't mess around with the cypher or key bytes.

Shows all data in my old home directory.

cd /home/paulj/Private
ls -la

Copy that junk out out of the encrypted drive to my desktop.

mkdir /home/paulj/Desktop/Backup
cp -Rv ./* /home/paulj/Desktop/Backup

I had actually stopped using core Ubuntu altogether due to disagreements with the Upgrade Ubuntu to the Newest Version, which successfully trashed two of my systems to a point where they were not reparable. I am currently running all of these commands from a clean Mint 12 install.

If you're just finding this thread, unless you specifically used password as your Passphrase, those hex values won't work.

share|improve this answer
1  
I'll accept this answer because it appears to contain the exact solution. My password wasn't actually "password" so my keys would be different. Alas, the drive has since been formatted because I gave up looking for a solution, so it's not of much relevance to me any more. And I've learned to not encrypt my home drive for no reason :-) –  Torben Gundtofte-Bruun Feb 25 '12 at 19:02
    
Pretty much the exact lesson I learned. I figured I'd post my experience to help any other person who stumbled on this thread. –  paulj Feb 26 '12 at 16:34
1  
@paulj You've earned the Ass Savior badge. –  robertodecurnex Mar 8 at 0:54
    
@robertodecurnex -- Happy to help, I've completely given up on Ubuntu, due to it constantly screwing me in some way. I stick to Mint Desktop and sometimes CENTOS server. –  paulj Mar 8 at 2:58

This is an attempt to fix it myself:

  1. Dustin Kirkland wrote in 2008:

    [...] you're trying to unwrap the mount passphrase with the wrong login password. You might try both your current, and your new password, or any other that you might have used. When you can unwrap your mount passphrase successfully, you should be able to perform the mount.

  2. The login username and login password for the new system are identical to the ones for the old system. I have written down the passphrase and I know it's correct (see proof in my question).

  3. This similar problem might be worth checking out: Trying to mount old encrypted home

  4. Also, something on the new system might not be working correctly. To rule this out, boot on a LiveCD and try from there.

...to be updated as I go along!

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.