To change encryption password I can use command:

cryptsetup luksChangeKey /dev/sda2

... and that works. But how to encrypt /dev/sda2 partition again with new password?

If my old password is compromised and I only change password, stored data is encrypted with old password not with new.

  • Please clarify: do you want to know how to change the master key? Doing so would require all data to be re-encrypted. – frostschutz Aug 18 '14 at 14:36

Your assumption is wrong.

The stored data is not encrypted with your passphrase, but with a key that is stored in one out of several (normally eight) key slots. Your passphrase is only used to encrypt/decrypt this key. The key then encrypts/decrypts the data in the LUKS container. When you change that passphrase, the key is re-encrypted with the new password.¹

This also means that you can have up to eight (or whatever the number of slots is) different passphrases for the same LUKS container, all being valid the same time. This way, you could give different people different passphrases and revoke them one by one, if not needed anymore. All key slots save the same key, but encrypted with different passphrases.

Caveat: An important conclusion is that you have not only to remember your passphrase but you should also make a backup of the LUKS header. Otherwise, if there is a fault in the LUKS header area, you won't get your data back, even if you still know you passphrase. (But you should have a backup of your data anyway.)

See details of the LUKS on-disk format here.

¹ Well, to be correct: If there is still a free key slot, the newly encrypted key is saved there and then the old slot is deleted.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.