When installing openSUSE or SUSE Linux Enterprise, YaST is able to configure encrypted LVM using LUKS for full disk encryption. The default configuration is aes-xts-plain64 using a 256 bit master key. However, due to how the XTC mode splits the key into two halves, this reduces the effective key size used for AES to 128 Bits.
In order to use a 512 bit key for 256 effective AES, one needs to perform manual formatting prior to installation:
cryptsetup LuksFormat --key-size 512 /dev/sda1
However the installer suffers from boo#1030299 which prevents it from writing an entry to /etc/crypttab in this instance. This results in a system that is unable to boot after installation.
The work-around is as follows: Boot into the rescue system, open the crypto device and enter the installed system as a chroot:
cryptsetup luksOpen /dev/sda1 crypto
mount /dev/mapper/system-root /mnt
for X in proc dev sys; do mount -bind /$ /mnt/$X; done
chroot /mnt
(This example assumes /dev/sda1 to be the crypto device, and an LVM VG named system with a LV named root, and no separate /boot.)
Then in the chroot, edit /etc/crypttab to have the following line:
crypto /dev/sda1 none none
See man crypttab for additional settings and options. To finalize, regenerate the initrd and reboot
mkinitrd
exit
reboot
A future rewrite of the YaST storage abstraction layer is planned which should address this issue.
Both comments and pings are currently closed.
