I'm trying to use cryptsetup to encrypt some partitions, but getting the error IO error while decrypting keyslot.

The command and output is:

root@rescue ~ # cryptsetup --debug --verbose --cipher aes-xts-plain64 --key-size 256 --hash sha256 --iter-time 6000 luksFormat  /dev/sda3
# cryptsetup 1.6.6 processing "cryptsetup --debug --verbose --cipher aes-xts-plain64 --key-size 256 --hash sha256 --iter-time 6000 luksFormat /dev/sda3"
# Running command luksFormat.
# Locking memory.
# Installing SIGINT/SIGTERM handler.
# Unblocking interruption on signal.

This will overwrite data on /dev/sda3 irrevocably.

Are you sure? (Type uppercase yes): YES
# Allocating crypt device /dev/sda3 context.
# Trying to open and read device /dev/sda3.
# Initialising device-mapper backend library.
# Timeout set to 0 miliseconds.
# Iteration time set to 6000 miliseconds.
# Interactive passphrase entry requested.
Enter passphrase: 
Verify passphrase: 
# Formatting device /dev/sda3 as type LUKS1.
# Crypto backend (gcrypt 1.6.3) initialized.
# Detected kernel Linux 4.9.85 x86_64.
# Topology: IO (512/0), offset = 0; Required alignment is 1048576 bytes.
# Checking if cipher aes-xts-plain64 is usable.
# Using userspace crypto wrapper to access keyslot area.
IO error while decrypting keyslot.
# Releasing crypt device /dev/sda3 context.
# Releasing device-mapper backend.
# Unlocking memory.
Command failed with code 5: IO error while decrypting keyslot.

I did find the code which throws this error, here, but it doesn't offer me any insight.

As you can see from the output, the partition gets formatted, but the keyslot is not written.

/dev/sda is a 3ware raid array, the partition table was written to the device by the debian installer. I found out (by mistake), that I can create a LUKS container on the entire device, but that's not a viable workaround for me because it's the only storage device on the server and I need an unencrypted /boot partition.


I figured this out, before the command in my question, I had tried the same thing while specifying a partition by uuid, something like:

cryptsetup <options> luksFormat /dev/disk/by-uuid/<disk uuid>

during this operation the uuid will change. I don't understand the minutia, but I ended up with a corrupt partition table.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.