can't open bitlocker encrypted devices with a clear key with cryptsetup but it works with dislocker

Question

I'm trying to open a bitlocker encryptet partition (/dev/nvme0n1p2) with cryptsetup, but it always returns the following error:

# cryptsetup -v open --type bitlk /dev/nvme0n1p2 crypt0
Enter passphrase for /dev/nvme0n1p2:
Command failed with code -1 (wrong or missing parameters).

The partition uses a clear encryption key and it works with dislocker

# dislocker -v /dev/nvme0n1p2 /mnt
# ls -lh /mnt
total 0
-rw-rw-rw- 1 root root 94G Jan  1  1970 dislocker-file

# cryptsetup -v bitlkDump /dev/nvme0n1p2
Info for BITLK device /dev/nvme0n1p2.
Version:        2
GUID:           xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
Sector size:    512 [bytes]
Created:        Sun Jan 19 17:59:34 2020
Description:    (null)
Cipher name:    aes
Cipher mode:    xts-plain64
Cipher key:     128 bits

Keyslots:
 0: VMK
    GUID:           xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
    Protection:     VMK protected with clear key
    Salt:           00000000000000000000000000000000
    Key data size:  44 [bytes]
 1: FVEK
    Key data size:  44 [bytes]

Metadata segments:
 0: FVE metadata area
    Offset:     49283072 [bytes]
    Size:       65536 [bytes]
 1: FVE metadata area
    Offset:     1635188736 [bytes]
    Size:       65536 [bytes]
 2: FVE metadata area
    Offset:     3319005184 [bytes]
    Size:       65536 [bytes]
 3: Volume header
    Offset:     111169536 [bytes]
    Size:       8192 [bytes]
    Cipher:     aes-xts-plain64
Command successful.

(I removed the GUIDs)

Versions:

# cryptsetup -v --version
cryptsetup 2.3.4

# dislocker -vh
dislocker by Romain Coltel, v0.7.1 (compiled for Linux/x86_64)
Compiled version: master:dcc08b5

Answer 1

cryptsetup currently doesn't support unlocking BitLocker devices with a clear key. So you'll need to use dislocker with this device. There is unfortunately still a lot of BitLocker features we don't support in cryptsetup.

Feel free to report an RFE issue on cryptsetup GitLab.

(Btw. It's weird, it doesn't show the correct error message, it should say: Activation of partially decrypted BITLK device is not supported. I should spend less time here and more time fixing bugs :-)