How can I get a HASH of the LUKS master key?

Question

From: https://code.google.com/p/cryptsetup/wiki/FrequentlyAskedQuestions

6.15 Can I clone a LUKS container?

You can, but it breaks security, because the cloned container has the same header and hence the same master key. You cannot change the master key on a LUKS container, even if you change the passphrase(s), the master key stays the same. That means whoever has access to one of the clones can decrypt them all, completely bypassing the passphrases.

The right way to do this is to first luksFormat the target container, then to clone the contents of the source container, with both containers mapped, i.e. decrypted. You can clone the decrypted contents of a LUKS container in binary mode, although you may run into secondary issues with GUIDs in filesystems, partition tables, RAID-components and the like. These are just the normal problems binary cloning causes.

Note that if you need to ship (e.g.) cloned LUKS containers with a default passphrase, that is fine as long as each container was individually created (and hence has its own master key). In this case, changing the default passphrase will make it secure again.

I have two notebooks with root access installed with LUKS. I don't know if originally they where CLONED or not.

My question: How can I create a HASH (ex.: sha512) from the LUKS master keys, so that I can compare the two, that if they are the same or not?

Answer 1

You can use

cryptsetup luksDump --dump-master-key /dev/whatever

in order to get the master key. Of course, you can hash the output to make it safe for transport:

cryptsetup ... | tail -2 | sed 's/^\(.*:\)\? *//' | sha1sum

Answer 2

Thanks for the answers, I created a sed command for it:

[root@notebook ~] test `whoami`=root && k=`cryptsetup luksDump -q --dump-master-key $(blkid | awk '/crypto_LUKS/ {print $1}' | cut -d: -f1 | head -1)` && echo "$k" | sed 's/^MK dump:/Fgkmtusjs\nMK dump:/g' | sed '1,/^Fgkmtusjs/d' | sed 's/.*\t//g' | sha512sum | sed "s/\-/`hostname`/g"
Enter LUKS passphrase: 
d78abb0542736865f94704521609c230dac03a2f369d043ac212d6933b91410e06399e37f9c5cc88436a31737330c1c8eccb2c2f9f374d62f716432a32d50fac  notebook.localdomain
[root@notebook ~]

tested on: Scientific Linux 6.4; Ubuntu 12.04

Answer 3

You can dump the master key using the --dump-master-key flag to luksDump:

cryptsetup --dump-master-key luksDump /dev/sda3

Example:

root@heredia:~# cryptsetup --dump-master-key luksDump /dev/sda3 

WARNING!
========
Header dump with volume key is sensitive information
which allows access to encrypted partition without passphrase.
This dump should be always stored encrypted on safe place.

Are you sure? (Type uppercase yes): YES
Enter passphrase: ********
LUKS header information for /dev/sda3
Cipher name:    aes
Cipher mode:    xts-plain64
Payload offset: 4096
UUID:           5f930991-3f91-47a4-b7ba-a40a3059f6bb
MK bits:        512
MK dump:        ab cd ef 00 01 02 03 04 05 ....

Note this doesn't dump a hash (as you asked), but instead the actual master key...