I'm not aware of a way to change LUKS keys without
cryptsetup. I'll edit this if I find a way. But I think I can help you with everything else.
I think you need clarity on how encryption fits into the grand scheme of things.
dm_crypt, through the
cryptsetup userspace utility, works on anything that looks like a block device. This can be an entire hard drive (i.e.
/dev/sda), a single partition of that hard drive (i.e.
/dev/sda1), or VG (volume group, i.e.
A VG will have previously been made a PV (physical volume) by using
pvcreate on one or more real disk partitions (like
/dev/sda1). Then, all of the PVs are junctioned into a VG using
vgcreate, which then creates a new device representing the VG in
/dev. Once you create the VG you need to format it by issuing a command such as
mkfs.ext4 /dev/volume_group, and then
mount /dev/volume_group to wherever. Looking at a plain
mount command run as root should give you an idea of what is where currently on your system.
An encrypted volume must be created by passing a block device (doesn't matter whether it's a real disk or a VG) to
cryptsetup luksFormat. At that time you can enter a passphrase or specify a keyfile. Then, to use it, you need to open that block device using
cryptsetup luksOpen (which prompts you for the previously assigned passphrase, or you can specify a keyfile); this will create another "virtual" block device in
/dev/mapper/encrypted. This is then what you want to give to tools like
mount to actually use the encrypted block device.
Important: Before you do the
cryptsetup luksFormat you want to overwrite the free space on your disk with random data, either with
dd or the
luksFormat doesn't do that and if you don't do that before hand an adversary can possibly tell where you've writen to the disk and where you haven't.
The point in using a volume group in combination with encryption on a single hard drive is usually to serve the same purpose as disk partitions, but since it's within an encrypted volume, your "partitioning" scheme can't be discovered unless it's unlocked. So you would take a full disk, create an encrypted volume, and use
lvcreate to create logical volumes which are then mounted as though they were partitions. (This explains it: http://linuxgazette.net/140/kapil.html)
Truly unmounting the volume will involve
umount /dev/mapper/encrypted to disconnect the filesystem and then a
cryptsetup luksClose encrypted to disconnect the virtual block device.
cryptsetup allows adding (
luksAddKey) and removing (
luksDelKey) keys. I think you can have up to 8 keys on an encrypted volume. A key is changed by adding a new key and then deleting the old key.
Specific syntax for all the
cryptsetup options are here: http://linux.die.net/man/8/cryptsetup