diff --git a/src/cryptsetup.c b/src/cryptsetup.c index 5e222866..6f8f9f88 100644 --- a/src/cryptsetup.c +++ b/src/cryptsetup.c @@ -3177,6 +3177,11 @@ static int action_reencrypt_luks2(struct crypt_device *cd) _set_reencryption_flags(¶ms.flags); + if (!ARG_SET(OPT_CIPHER_ID) && crypt_is_cipher_null(crypt_get_cipher(cd))) { + log_std(_("Switching data encryption cipher to %s.\n"), DEFAULT_CIPHER(LUKS1)); + ARG_SET_STR(OPT_CIPHER_ID, strdup(DEFAULT_CIPHER(LUKS1))); + } + if (!ARG_SET(OPT_CIPHER_ID)) { strncpy(cipher, crypt_get_cipher(cd), MAX_CIPHER_LEN - 1); strncpy(mode, crypt_get_cipher_mode(cd), MAX_CIPHER_LEN - 1); diff --git a/tests/luks2-reencryption-test b/tests/luks2-reencryption-test index b7d97017..51b54735 100755 --- a/tests/luks2-reencryption-test +++ b/tests/luks2-reencryption-test @@ -1419,9 +1419,9 @@ $CRYPTSETUP close $DEV_NAME echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks1 -s 128 -c cipher_null-ecb --offset 8192 $FAST_PBKDF2 $DEV || fail $CRYPTSETUP convert -q --type luks2 $DEV || fail wipe $PWD1 -echo $PWD1 | $CRYPTSETUP reencrypt $DEV -c aes-xts-plain64 -q $FAST_PBKDF_ARGON || fail +echo $PWD1 | $CRYPTSETUP reencrypt $DEV -q $FAST_PBKDF_ARGON >/dev/null || fail check_hash $PWD1 $HASH1 -# both keyslot and segment cipher must not be null +# both keyslot and segment cipher must not be null after reencryption with default params $CRYPTSETUP luksDump $DEV | grep -q "cipher_null" && fail remove_mapping