Problem with encryption algorithm 'aes256'

Question

I am following this method to encrypt external hard-drive but there is a problem with aes algorithm alias

sudo modprobe dm-crypt
sudo modprobe sha256
sudo modprobe aes

I get following error after aes command

modprobe: ERROR: could not insert 'padlock_aes': No such device

I tried the workaround mentioned in the link, but there is no aliases file in my /etc/modprobe.d/ directory

user@user:/home/$ cd /etc/modprobe.d/

user@user:/etc/modprobe.d$ ls | grep aliases

user@user:/etc/modprobe.d$ [no output]

I don't know how to handle this, but afterwards when I tried encrypting drive it was successfully encrypted by following command

sudo cryptsetup --verify-passphrase luksFormat /dev/sdb1 -c aes -s 256 -h sha256

I don't know how did it find aes256 algorithm,or just ignored aes256 or did a some magical stuff.

So I want an answer to following questions

1. How was crypt-setup able to encrypt my drive successfully?

2. How to confirm that aes256 is also implemented in that encryption performed by crypt-setup?

3. Why don't I have a /etc/modprobe.d/alaises file? Is it due to newer version? since the solution was last tested on version 10.04.

Answer 1

General warning in advance: do not manually change the cryptsetup parameters with options like -c (--cipher), -s (--key-size) and -h (--hash). The defaults are generally sane enough and unless you know what you are doing, you might actually select worse parameters.

These defaults are shown with cryptsetup --help. For reference, on Ubuntu 16.04 with cryptsetup 1.7.2, the defaults are:

LUKS1: aes-xts-plain64, Key: 256 bits, LUKS header hashing: sha1, RNG: /dev/urandom

On Arch Linux with cryptsetup 1.7.2, the defaults are:

LUKS1: aes-xts-plain64, Key: 256 bits, LUKS header hashing: sha256, RNG: /dev/urandom

---

The instructions you linked were written for a Ubuntu version released in 2010. Nowadays (and maybe even back then) you do not have to manually load kernel modules in order to setup full disk encryption. These are automatically loaded when cryptsetup is invoked.

In the context of Linux kernel modules, the aes name is a module name and alias for several possible implementations. There is one generic aes module which is built into the kernel image. Then there are alternative, faster implementation which depend on some hardware or CPU capabilities (like padlock-aes and aesni-intel).

Even if these hardware-accelerated modules cannot be loaded, there is still the fallback to the generic AES implementation which is why cryptsetup can still use it.

To confirm that AES256 encryption is indeed in use, you can use the cryptsetup luksDump /dev/sdb1 command which shows something like:

...                                        
Cipher name:    aes
Cipher mode:    xts-plain64
Hash spec:      sha256
Payload offset: 4096
MK bits:        256

Here you can see that the AES cipher was used using the SHA256 hash function for password derivation. The key size is 256 bits (so you are indeed using AES256).

For your last question (why you do not have an /etc/modprobe/aliases file), this file does not exist in recent Ubuntu versions.