When using cryptsetup with LUKS, the manual uses the terms "key" and "size" multiple time, for example:

--keyfile-size (in bytes)
--key-size (in bits)

The allowed values for --key-size is 256 bits (default) or 512 bits.

Later, under the clause 'Default compiled-in key and passphrase parameters:' it says:

Maximum keyfile size: 8192kB, Maximum interactive passphrase length 512 (characters)

I'm getting confused in the meaning of these keys.
What is the point of the key which is related to flag --key-size?
Shouldn't it be the same key which is related to flag --keyfile-size or to the passphrase?

1 Answer 1


--key-size is the size of the volume key, which is the key that encrypts all of the data in the volume. It is automatically generated when you format the volume and is encrypted by your passphrase. --keyfile-size is the maximum number of bytes to read from a keyfile, which you would use if you want to unlock the volume using a file instead of a passphrase. You only need --keyfile-size if you don't want cryptsetup to read the whole file up to the maximum keyfile size.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .