diff --git a/model/Disk.cpp b/model/Disk.cpp
index becf8b7..9fcf5e1 100644
--- a/model/Disk.cpp
+++ b/model/Disk.cpp
@@ -30,6 +30,8 @@
 #include <android-base/parseint.h>
 #include <ext4_utils/ext4_crypt.h>
 
+#include "cryptfs.h"
+
 #include <vector>
 #include <fcntl.h>
 #include <inttypes.h>
@@ -480,7 +482,7 @@
     }
 
     std::string keyRaw;
-    if (ReadRandomBytes(16, keyRaw) != OK) {
+    if (ReadRandomBytes(cryptfs_get_keysize(), keyRaw) != OK) {
         LOG(ERROR) << "Failed to generate key";
         return -EIO;
     }
diff --git a/model/PrivateVolume.cpp b/model/PrivateVolume.cpp
index 48d041b..cf21577 100644
--- a/model/PrivateVolume.cpp
+++ b/model/PrivateVolume.cpp
@@ -65,6 +65,11 @@
     if (CreateDeviceNode(mRawDevPath, mRawDevice)) {
         return -EIO;
     }
+    if (mKeyRaw.size() != cryptfs_get_keysize()) {
+      PLOG(ERROR) << getId() << " Raw keysize " << mKeyRaw.size() <<
+          " does not match crypt keysize " << cryptfs_get_keysize();
+      return -EIO;
+    }
 
     // Recover from stale vold by tearing down any old mappings
     cryptfs_revert_ext_volume(getId().c_str());
@@ -74,7 +79,7 @@
     unsigned char* key = (unsigned char*) mKeyRaw.data();
     char crypto_blkdev[MAXPATHLEN];
     int res = cryptfs_setup_ext_volume(getId().c_str(), mRawDevPath.c_str(),
-            key, mKeyRaw.size(), crypto_blkdev);
+            key, crypto_blkdev);
     mDmDevPath = crypto_blkdev;
     if (res != 0) {
         PLOG(ERROR) << getId() << " failed to setup cryptfs";