If someone has stolen the head of LUKS disk and hacked my LUKS passphrase, and I then change the passphrase, can the person still decrypt my data using the stolen head? If yes, what can I do to prevent this without losing data? cryptsetup-reencrypt looks like it might be the solution, but I'm not sure.


Firstly, any operation which involves moving a bunch of data around on disk, such as re-encrypting a LUKS container, has the inherent risk of data loss. The only measure you can take against data loss is to have a reliable backup.

WARNING: The cryptsetup-reencrypt program is not resistant to hardware or kernel failures during reencryption (you can lose you data in this case). ALWAYS BE SURE YOU HAVE RELIABLE BACKUP BEFORE USING THIS TOOL. - source: man cryptsetup-reencrypt

That said, yes the stolen LUKS header can be used to unlock the LUKS container. The reason is the passphrase(s) are never used to encrypt the data. Instead, a completely different encryption key is used. And this key is never changed; Unless you re-write the LUKS container, which is essentially what cryptsetup-reencrypt does. The passphrase(s) simply provides a way to access the real encryption key.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.