3

I am attempting to add a homekey entry to my /etc/crypttab in order to prevent entering a 3rd pass upon login on a 14.04 install w/ LUKS (root/swap/home). When I attempt to add the key using cryptsetup luksAddKey I get the maximum keyfile size exceeded error.

I have attempted to use the --keyfile-size 512 argument to see if it would override it, but it did not fix it.

Also, is there a way to do this same process for the swap, so that I only have to enter one password at boot? Or would doing that sacrifice security?

  • Is the swap on a LUKS volume by itself, separate from the root and home LUKS volumes? It could also be a raw dm-crypt volume with a randomly generated key on each boot. Posting the outputs of lsblk, cat /etc/fstab, and sudo dmsetup table will help. – Vincent Yu Jul 29 '15 at 3:44
1

It sounds like the key file that you are trying to use is at least 8 KiB, which exceeds cryptsetup's default maximum size. You can use the --new-keyfile-size <size_in_bytes> option to force cryptsetup to use the key, but I recommend using a random key with a smaller size, because a key that is larger than the master key of the LUKS volume offers no additional security over a key that is the same size as the master key (as long as the key material is truly random).

The maximum master key size for LUKS is 512 bits, but it can also be 256 bits. You can check the size of your master key by finding the size of "MK bits" in sudo cryptsetup luksDump /dev/<device>.

I suggest generating keys from /dev/random. For example, to generate a random 512-bit (64-byte) key:

head -c 64 /dev/random > luks_key
| improve this answer | |
  • Thank you for the response, I will give this a try - Im sure it will fix it! the key was generated from /dev/random. Is it possible to do this same setup for the swap as well? Its a long password to type twice :/ – Sorn Jul 29 '15 at 4:24
  • Hum, tried what you said and it allowed the command, however now its not mounting home :( Any easy way to fix this using manual recovery? Damn me – Sorn Jul 29 '15 at 4:49
  • Simply adding a key with cryptsetup luksAddKey should not affect your set up in any way. You mentioned modifying /etc/crypttab in your question. Did you modify crypttab or fstab, and what commands exactly did you run to add the key? – Vincent Yu Jul 29 '15 at 4:59
  • Yes, I modified /etc/crypttab following the instructions here: thesimplecomputer.info/full-disk-encryption-with-ubuntu Its near the very bottom. Is there a easy way to use manual recovery to recover the crypttab? or do you see something wrong with that tut that would have caused it to not boot? All I changed was the --new-keyfile-size 8000 to reflect the key I had generated and Crypttab looked like this: home UUID=UUIDHERE /root/homekey luks – Sorn Jul 29 '15 at 5:46
  • To reiterate my answer, I recommend using a smaller key file so that you don't need to use --new-keyfile-size with cryptsetup luksAddKey; I don't know if crypttab supports truncating a key file. Anyway, it's easy to revert to using a password: boot into recovery, revert crypttab (the relevant line should be something like home UUID=<uuid> none luks), and rerun update-initramfs -u. – Vincent Yu Jul 29 '15 at 6:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.