I have the following requirements:

  • I have an LVM volume A, encrypted with key K1 using LUKS.
  • I need to make a copy-on-write snapshot of A such that
    • Writes to A will continue to be encrypted under K1
    • Writes to the snapshot will be encrypted under K2, which is different from K1.

The use case is to allow the snapshot to be securely deleted by deleting the encryption key.

Is this possible?


No, it is not possible to change the LUKS encryption key when making an LVM snapshot.

LUKS is unaware of LVM, so this would be no different than cloning a partition and expecting to be able to change the encryption key.

Now, you MAY be able to achieve your goal if you flip LVM and LUKS. It's a complex setup that goes something like this:

  1. Create multiple LUKS containers in partitions, each with a different key, of course.
  2. Create an LVM volume group which uses the unlocked LUKS containers as physical volumes.
  3. When you create logical volumes, specify which physical volume to use; This will determine which LUKS key is used for the logical volume.
  4. When you create a snapshot, specify a different physical volume; This means writes to this volume would be encrypted with a different LUKS key.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.