[CentOS] LUKS encypted partition using --key-file can only be decrypted with --key-file

On 04/03/15 06:33 PM, Robert Nichols wrote:
> On 03/04/2015 03:16 PM, Digimer wrote:
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA1
>>
>> Hi all,
>>
>>    I created a LUKS encrypted partition via a udev-triggered script on
>> 6.6 using --key-file /tmp/foo. This worked fine, and I can decrypt the
>> LUKS partition via script and manually using --key-file with luksOpen.
>>
>>    The odd problem is that I can't decrypt the partition using the
>> prompt. If I manually create a file with the passphrase in it and then
>> point to it with --key-file, it decrypts fine. I used 'cat -A
>> /tmp/foo' to verify that there was no '\n' at the end of the phrase.
>>
>>    Is this expected behaviour? That is; If you create an encrypted
>> partition using --key-file, you always decrypt with the same? If so, I
>> can't understand the logic... If not, then I am not sure what I am
>> doing wrong.
> 
> Try again including "--hash plain" on the command line.  When the
> key is read from a keyfile, no hash is used and the key is simply
> truncated to the correct length (too short is an error). A key read
> from the terminal or from stdin is hashed, then truncated or padded
> to the proper length.
> 
> See "NOTES ON PASSWORD PROCESSING" in the cryptsetup manpage.
> Presumably, if you stored the hashed key phrase in the keyfile
> (DAMHTDT) it would work from the terminal without "--hash -plain".

Reviving a very old thread...

I tried this (cryptsetup --hash plain luksOpen /dev/sdb1 sdb1) but it
fails to recognize the passphrase at the command line still. When I
tried to use '--hash plain' on luksFormat, I get:

[root at dashboard1 ~]# echo YES | cryptsetup --hash plain luksFormat
/dev/sdb1 /tmp/password
Requested LUKS hash plain is not supported.

I suspect I'm misunderstanding something. I've read "NOTES ON PASSWORD
PROCESSING" and as best I can figure, the root of the problem is the
padding. I'm not so strong on security, so when I look at /proc/crypto,
I get lost.

Is there a "for dummies" document that I could look at to do what it is
I am trying to do? That is; create the encrypted device from a script
(which is why I am using --key-file) and then decrypt it later with
normal STDIN via cryptsetup luksOpen?

Thanks!

-- 
Digimer
Papers and Projects: https://alteeve.ca/w/
What if the cure for cancer is trapped in the mind of a person without
access to education?