2

After reading "man cryptsetup" and many StackExchange questions, I'm confused: Does LUKS use the same master key in each slot?

If I execute the commands below, the displayed master key does not change--i.e., additional master keys are not listed.

cryptsetup luksDump /dev/xvdd1
cryptsetup luksAddKey /dev/xvdd1 --key-slot 1
cryptsetup luksAddKey /dev/xvdd1 --key-slot 2
cryptsetup luksDump /dev/xvdd1

Is this a terminology problem? Meaning, you have:

  • master key (for encrypting and decrypting the partition)
  • password (for encrypting the master key)
  • key file (for encrypting the master key)
3

Yes, it's the same master key. After all, you only have one copy of your data on disk, which is encrypted one way only, so as far as the data itself is concerned there is only ever one key. If you used different master keys you'd see different "random" data for each key slot, which is not very useful. It's possible to change the master key but it involves re-encrypting all the data (see cryptsetup-reencrypt).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.