[pkg-cryptsetup-devel] Bug#890798: cryptsetup: Using luks2 produces an unbootable system

Sun Feb 18 23:02:02 UTC 2018

Package: cryptsetup
Version: 2:2.0.1-1
Severity: important

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Dear Maintainer,

Since in Debian Sid we have a cryptsetup v2 for some time, I wanted to wipe my
current system and install a fresh one in the  LUKS/LVM setup. I was using the
official Debian live images, and of course I installed cryptsetup and lvm2 from
the Sid branch. The next step was to create a LUKS2 container, and I did it
with the following command:

cryptsetup luksFormat /dev/sdb1 \
- --type luks2 \
- --cipher aes-xts-plain64 \
- --key-size 512 \
- --hash sha512 \
- --pbkdf argon2i \
- --pbkdf-force-iterations 2 \
- --pbkdf-memory 1048576 \
- --pbkdf-parallel 1 \
- --label debian \
- --subsystem "" \
- --use-random \
- --verify-passphrase \
- --verbose \

The container (and the rest of the setup) was created successfully, and I
installed a Debian Sid minimal system using debootstrap. I did everything as
usual when I install Debian in this way, but when the system was about to boot,
it failed. The LUKS2 container could be easily opened using that livecd (with
the cryptsetup and lvm2 package from Sid), but system was unable to boot with
an error saying something about missing libgcc_s.so.1 .

I tried to fix this locally and added the missing lib to the initramfs, but
unfortunately this step fixed the issue only partially -- the system was able
to detect the LVM volumes but it was asking to type password for the container
again and again, and the boot failed ultimately.

I also found this link that describes the exact same issue.
https://bugs.archlinux.org/task/56771