This is a way I enter a new passphrase for my encrypted volume:

sudo cryptsetup luksAddKey --key-slot 4  /dev/sda5

Unfortunately, cryptsetup does not ask to confirm the new passphrase. How to make sure that the passphrase I have entered is the one that I actually meant?

I see two workarounds.

  1. Reboot and try the new passphrase.
  2. Add a temporary passphrase to another slot with the help of the new passphrase. Kill the temporary passphrase.

Is there a more elegant way?

  • 1
    --verify-passphrase... – jasonwryan May 7 '18 at 8:14

Just run cryptsetup with argument -y.

From the manpage of cryptsetup:

--verify-passphrase, -y
    query for passwords twice. Useful when creating a (regular) mapping for the first time, 
    or when running luksFormat. 

The system would ask twice for an existing passphrase and for a new one:

$ sudo cryptsetup luksAddKey -y --key-slot 4  /dev/sda5
Enter any existing passphrase: 
Verify passphrase: 
Enter new passphrase for key slot: 
Verify passphrase: 
Passphrases do not match.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.