3

If someone steals our master key to the FDE/LUKS, then we have to re-create the LUKS device, or is it enough to only change the LUKS password?

1 Answer 1

3

The master key is what encrypts the disk. All other keys and passwords provide access only to the master key.

The reasoning behind this is that if you want to change the LUKS password (or have several of them) only a tiny amount of data needs to be encrypted or re-encrypted. The disadvantage is that once your master key is compromised your entire data set is compromised.

Since your master key is no longer secure, it no longer matters what your LUKS passwords are. Rather, at this point you should replace and rebuild the entire LUKS volume, ensuring it has a fresh master key. You should also examine your security procedures to determine how your previous master key was compromised in the first place.

Fortunately, the cryptsetup-reencrypt tool will allow you to do this in place provided you can take the volume offline for the duration of the process. As ever, taking a backup beforehand is strongly recommended. Synopsis from the man page:

cryptsetup-reencrypt can be used to change reencryption parameters which otherwise require full on-disk data change (re-encryption). You can regenerate volume key (the real key used in on-disk encryption unclocked by passphrase), cipher, cipher mode.

2
  • would "cryptsetup-reencrypt" help? does it re-generates the master key?
    – Marina Ala
    Commented Mar 23, 2017 at 11:01
  • @MarinaAla looks like it, yes. BACKUP YOUR DATA before you try it out. Commented Mar 23, 2017 at 11:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .