#1126717 partman-crypto: (Debian sinstallation)random key encrypted swap using xts doesn't double the key size in the final /etc/crypttab

Package:
src:partman-crypto
Source:
src:partman-crypto
Submitter:
Aleks
Date:
2026-02-04 18:41:03 UTC
Severity:
normal
#1126717#5
Date:
2026-01-31 14:16:22 UTC
From:
To:
Dear Maintainer,

When installing debian using the default iso i wanted to setup an encrypted swap.
I selected the option aes and the random key option and a key size of 256. I know that doing so for my root partition worked fine, it used luks and used a doubled key(in my case i selected 256 and it doubled it to 512)
But when i check in /etc/crypttab i see that even though i also used 256 for the swap partition, it didn't double it and it still says 256.
I guess it's not that much of a problem if you use 256, but if you use 128 it may be a securty problem perhaps
I expected the final /etc/crypttab to contain a doubled key size, but it didn't
#1126717#10
Date:
2026-01-31 14:27:23 UTC
From:
To:
i forgot to mention that it is aes-xts
If it help somehow, my final /etc/crypttab entry after finishing the debian
installation is as follows:
sda4_crypt /dev/sda4 /dev/urandom
cipher=aes-xts-plain64,size=256,swap,discard,x-initrd.attach
#1126717#15
Date:
2026-01-31 18:56:50 UTC
From:
To:
other modes and half of it is the cipher key, the other half is the XTS
key" (from cryptsetup FAQ). For a 256-bit cipher key, you must specify a
512-bit key size to cryptsetup.
Indeed, if XTS mode is selected then setup_luks() in lib/crypto_base.sh
doubles the key size when formatting an encrypted volume with
LUKS+passphrase and setup_dmcrypt() does the same when opening an
encrypted volume with plain dm-crypt+random key; however
crypttab_add_entry() in finish.d/crypto_config does not double the key
size when writing a crypttab entry for plain dm-crypt+random key. It
looks like commit 1cd80dd8 ("Also double key size for non-luks xts") was
incomplete.

I can add a trivial fix to my pending plain dm-crypt enhancements and
bugfixes (MR !4).
#1126717#20
Date:
2026-02-04 18:07:32 UTC
From:
To:
Yes, thank you, add your fix to your merge request. I am not a debian
expert so i really don't know how to test it before a installation iso is
released, but once i am able to get an installation iso with the fix, i
will test it :)
#1126717#25
Date:
2026-02-04 18:40:07 UTC
From:
To:
You can test with this amd64 mini.iso netboot image (network is required
during installation):
<https://salsa.debian.org/pham/partman-crypto/-/jobs/8987799/artifacts/file/debian/output/debian-20250804+salsaci+20260204+51-amd64-gtkmini.iso>