NetBSD Problem Report #60959

From www@netbsd.org  Tue Nov  3 23:30:57 2026
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256
	 client-signature RSA-PSS (2048 bits) client-digest SHA256)
	(Client CN "mail.netbsd.org", Issuer "YR1" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id EBB721A923B
	for <gnats-bugs@gnats.NetBSD.org>; Tue,  3 Nov 2026 23:30:56 +0000 (UTC)
Message-Id: <20261103233055.637731A923C@mollari.NetBSD.org>
Date: Tue,  3 Nov 2026 23:30:55 +0000 (UTC)
From: el@horse64.org
Reply-To: el@horse64.org
To: gnats-bugs@NetBSD.org
Subject: AES-CBC 512 seems to bug out sometimes during cgdconfig -V re-enter while AES-XTS 512 with same parameters doesn't
X-Send-Pr-Version: www-1.0
X-From4GNATS: "el@horse64.org via gnats" <gnats-admin@NetBSD.org>

>Number:         60959
>Category:       misc
>Synopsis:       AES-CBC 512 seems to bug out sometimes during cgdconfig -V re-enter while AES-XTS 512 with same parameters doesn't
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    misc-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Tue Nov 03 23:35:00 +0000 2026
>Last-Modified:  Wed Nov 04 00:15:01 +0000 2026
>Originator:     Ellie
>Release:        
>Organization:
>Environment:
I sadly didn't capture the respective output when using the NetBSD 11.0 installer where I tested this in the rescue console, but here's the one after installing: NetBSD ruby-b-s-delly 11.0_STABLE NetBSD 11.0_STABLE (GENERIC) #0: Fri Oct 30 19:02:53 UTC 2026  mkrepro@mkrepro.NetBSD.org:/usr/src/sys/arch/amd64/compile/GENERIC amd64
>Description:
(Sorry if the category is wrong!)

AES-CBC 512 seems to bug out sometimes during cgdconfig -V re-enter, leading to an interesting wrong block size error. This is an example of a config that broke for me:

algorithm aes-cbc;
iv-method encblkno1;
keylength 512;
verify_method disklabel;
keygen pkcs5_pbkdf2/sha1 {
        iterations 3775370;
        salt AAAAgCGjG2AHyP0MjuDyMDWisNc=;
};

It gives an "ioctl: Invalid argument" when running cgdconfig -V re-enter, after a warning about a too large block size.

Meanwhile AES-XTS 512 with same parameters then worked;

algorithm aes-xts;
iv-method encblkno1;
keylength 512;
verify_method disklabel;
keygen pkcs5_pbkdf2/sha1 {
        iterations 3775370;
        salt AAAAgCGjG2AHyP0MjuDyMDWisNc=;
};

I don't know if there's something that I did wrong about this, but some other NetBSD users who looked at this seemed to encourage me in thinking it might be a bug. If it's not a bug, please feel free to close or ignore this!
>How-To-Repeat:
1. Put this into /etc/cgd/cgdroot.cfg or a similar config file:

algorithm aes-cbc;
iv-method encblkno1;
keylength 512;
verify_method disklabel;
keygen pkcs5_pbkdf2/sha1 {
        iterations 3775370;
        salt AAAAgCGjG2AHyP0MjuDyMDWisNc=;
};

2. Run: cgdconfig -V re-enter cgd0 NAME=cgdroot /etc/cgdroot/cgdroot.cfg and enter some test password. It should fail with "ioctl: Invalid argument".
>Fix:

>Audit-Trail:
From: Ellie <el@horse64.org>
To: gnats-bugs@netbsd.org, misc-bug-people@netbsd.org, netbsd-bugs@netbsd.org
Cc: 
Subject: Re: misc/60959: AES-CBC 512 seems to bug out sometimes during
 cgdconfig -V re-enter while AES-XTS 512 with same parameters doesn't
Date: Wed, 4 Nov 2026 00:14:35 +0000

 On 11/3/26 23:35, gnats-admin@netbsd.org wrote:
 > Thank you very much for your problem report.
 > It has the internal identification `misc/60959'.
 > The individual assigned to look at your
 > report is: misc-bug-people.
 > 
 >> Category:       misc
 >> Responsible:    misc-bug-people
 >> Synopsis:       AES-CBC 512 seems to bug out sometimes during cgdconfig -V re-enter while AES-XTS 512 with same parameters doesn't
 >> Arrival-Date:   Tue Nov 03 23:35:00 +0000 2026
 > 
 Oops, seems like it was a user error in my behalf after all:

 https://mail-index.netbsd.org/netbsd-users/2026/10/31/msg035138.html

 Perhaps it would be useful to improve the error message? Also, cgdconfig 
 -g happily produces an according config:

 $ cgdconfig -g -o ./testfile.cfg aes-cbc 512
 pkcs5_pbkdf2: calibrating iterations................. done
 $ cat testfile.cfg
 algorithm aes-cbc;
 iv-method encblkno1;
 keylength 512;
 verify_method none;
 keygen pkcs5_pbkdf2/sha1 {
          iterations 378453;
          salt AAAAgCymR3AKBAk7bnmdY+xNOp8=;
 };
 $

 ...which makes this a little harder to realize as an invalid config as a 
 user. Sorry, I hope this feedback is useful!

 Regards,

 Ellie

Home	PR Database Search