From f7d9ad09256df06f2e7cbb7e513332f2094973c0 Mon Sep 17 00:00:00 2001 From: Ben Grande Date: Tue, 21 Jul 2026 11:09:51 +0200 Subject: [PATCH] Explicit key size to silence cryptsetup warning We trust cryptsetup to provide sane defaults, but being implicit logs the following warning for every ephemeral volume on qube startup: WARNING: Using default options for cipher (aes-xts-plain64, key size 256 bits) that could be incompatible with older versions. For plain mode, always use options --cipher, --key-size and if no keyfile or keyring is used, then also --hash. This is the reason why "--cipher" and "--key-size" are specified. A better solution would be to silence the warning and be implicit, as we don't care about the key for this volume, we'd always get the new cryptsetup default, but I didn't find a way to silence this warning. Fixes: https://github.com/qubesos/qubes-issues/issues/10989 --- qubes/storage/__init__.py | 1 + 1 file changed, 1 insertion(+) diff --git a/qubes/storage/__init__.py b/qubes/storage/__init__.py index 5da497171..a5fbdb37f 100644 --- a/qubes/storage/__init__.py +++ b/qubes/storage/__init__.py @@ -238,6 +238,7 @@ async def start_encrypted(self, name): await qubes.utils.cryptsetup( "--key-file=/dev/urandom", "--cipher=aes-xts-plain64", + "--key-size=256", "--type=plain", "--", "open",