I have a problem booting my Debian Linux server. After a system update, GRUB loads the initrd and the system should ask for the password, but it doesn't. Instead, I get dropped to BusyBox. After trying to mount the encrypted volume manually with cryptsetup luksOpen, I get this error:

device-mapper: table: 254:0: crypt: Error allocating crypto tfm
device-mapper: reload ioctl failed: Invalid argument
Failed to setup dm-crypt key mapping for device /dev/sda3
Check that the kernel supports aes-cbc-essiv:sha256 cipher (check syslog for more info).


  • Do you have the cbc module loaded? – derobert Apr 29 '13 at 19:23
up vote 2 down vote accepted

Your kernel lacks support for aes-cbc-essiv:sha256. “Error allocating crypto tfm” refers to the kernel's cryptographic subsystem: some necessary cryptographic data structure couldn't be initialized. Your support for cryptographic algorithms comes in modules, and you have a module for the AES algorithm and a module for the SHA-256 algorithm, but no module for the CBC mode. You will not be able to mount your encrypted device without it.

If you compiled your own kernel, make sure to enable all necessary crypto algorithms. If your kernel comes from your distribution, this may be a bug that you need to report. In either case, there must be a module /lib/modules/2.6.32-5-amd64/kernel/crypto/cbc.ko. If the module exists, then your problem is instead with the initramfs generation script.

In addition to the cbc module, you need other kernel components to tie the crypto together. Check that CRYPTO_MANAGER, CRYPTO_RNG2 and CRYPTO_BLKCIPHER2 are set in your kernel configuration. Debian's initramfs building script should take care of these even if they're compiled as modules. As the crypto subsystem is rather complex, there may be other vital components that are missing from the initramfs script. If you need further help, read through the discussion of bug #541835, and post your exact kernel version, as well as your kernel configuration if you compiled it yourself.

You will need to boot from a rescue system with the requisite crypto support to repair this. Mount your root filesystem, chroot into it, mount /boot, and run dpkg-reconfigure linux-image-… to regenerate the initramfs.

  • Thank you for your answer! I´ve not compiled the kernel myself, it came with debian. I booted a rescue system yesterday and updated the initramfs with update-initramfs -v -k all -u. I´m going to update it again with dpkg-reconfigure and try to fix it. – TobiasPC Apr 30 '13 at 17:38
  • Nice. I added the cbc module in my initramfs and now i can boot. But there is still a little problem, the root partition /dev/sda3/ gets mounted on /dev/mapper/cryptroot/. It should be mounted on /dev/mapper/sda3_crypt, otherwise the system waits for the wrong device. Where can i set the mappings name? Images – TobiasPC May 1 '13 at 12:22
  • @TobiasPC /etc/crypttab. I think it's enough to update the file on your live installation, then run update-initramfs. – Gilles May 1 '13 at 15:53
  • Ok, thanks, but there is no entry for my / in my crypttab, as it gets mounted in the initrd. I need to change this into sda3_crypt – TobiasPC May 1 '13 at 16:12
  • Everything works now. I had to add this cryptopts=target=sda3_crypt,source=/dev/sda3 to my kernel boot arguments. Thanks everyone! – TobiasPC May 4 '13 at 15:17

Your Answer


By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.