I would like to convert my raid6 mdadm into encrypted LUKS. Right now raid6 consists of "/dev/sdX1" which are raid partitions. /dev/md0 doesn't have a partition - it is pure ext4 FS.

Is it safe to reencrypt (cryptsetup-reencrypt /dev/md0)? Will LUKS add some specific header which could cause data loss/FS corrupt? Or is it safe only when you have partition on top of mdadm (i.e. /dev/md0p1)?

1 Answer 1


A volume is called a "LUKS volume" because it has a LUKS header. Thus if you convert a non-LUKS volume into a LUKS volume then you do get an additional header and do lose data space.

The LUKS header can be on a differenct device (--header) but I do not know whether cryptsetup-reencrypt supports that. But most probably you want to have the LUKS header within the RAID anyway.

Thus you have to

  1. reduce the file system size by at least 4MiB

  2. run cryptsetup-reencrypt with --new and --reduce-device-size

I suggest that you decrease the file system size by a bit more than the value for --reduce-device-size (which I guess must be 4MiB or more).

You may want to overwrite the gap between the encrypted LUKS data and the end of the device with random data afterwards. But be really careful with that. You should first make a backup (to a different volume, of course) of the blocks you are going to overwrite.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .