LUKS: Wrong Password or Corrupt Headers?

Question

I'm trying to gain access to my LUKS partitions after suddenly discovering that my password stopped working on all 4 LUKS partitions. 7 days ago when I tried booting and logging into my linux OS, my password stopped working.

I have 4 partitions that are encrypted with LUKS. 3 Partitions are on my linux main drive, they include the root filesystem, the home partition and the swap. Another extended home partition is on another drive. They are all encrypted with the same password. 3 partitions are auto decrypted with a keyfile from the root filesystem LUKS partition on startup, so only one password is required for me to login.

I encrypted my drives 5 months ago, and I was using the password every single day. Is it possible I had sudden loss of memory of my password? I don't feel like my password is incorrect. Password looks correct when typed out on screen.

I also have a dual boot setup with windows 7 on a separate drive. I logged in to windows the day before my linux password stopped working. Could windows 7 have corrupted 4 LUKS partitions on 2 drives at the same time without asking me? Has anything like this happened before?

Unfortunately I don't have a password or header backup for the partitions.

I've tried accessing my LUKS partitions many times over the last week. I used a live linux cd to attempt opening my partitions, but every time cryptsetup says the password is incorrect.

sudo cryptsetup --type luks open /dev/sdb1 encrypted
sudo cryptsetup --type luks open /dev/sdf2 encrypted2
sudo cryptsetup --type luks open /dev/sdf3 encrypted3
sudo cryptsetup --type luks open /dev/sdf4 encrypted4

No key available with this passphrase.

I've tried opening all 4 partitions with cryptsetup. I've tried changing my keyboard layout between UK and US, but no luck. Cryptsetup luksdump shows that all 4 partitions still have LUKS headers; one partition (root fs) with 1 keyslot, and the other 3 with 2 keyslots, I'm guessing the second keyslot is the auto keyfile.

$ sudo cryptsetup -v isLuks /dev/sdb1
Command successful.
$ sudo cryptsetup luksDump /dev/sdb1
LUKS header information for /dev/sdb1

Version:        1
Cipher name:    aes
Cipher mode:    xts-plain64
Hash spec:      sha512
Payload offset: 4096
MK bits:        512
MK digest:      08 ca 09 9f c3 b0 cf cf bc 36 97 52 2c 03 4d c3 1e 0b fe c9 
MK salt:        4b 76 75 23 1e d5 7a ad 18 bc 37 e4 42 55 51 a3 
                7a ef e1 f2 c4 dc d0 fe 71 27 f1 64 d7 b6 1c ba 
MK iterations:  732500
UUID:           89e80b59-cb5a-42c8-8001-ecf92206aca6

Key Slot 0: ENABLED
    Iterations:             5878300
    Salt:                   59 3e cb 7f 11 c8 93 db 1e 62 0c 98 d1 c6 6e fc 
                            ea 65 f2 6d ff a7 20 c2 48 69 d2 2a 5b 76 07 2e 
    Key material offset:    8
    AF stripes:             4000
Key Slot 1: ENABLED
    Iterations:             2400937
    Salt:                   18 26 74 ce 42 57 cc e8 82 f5 23 ef 65 1d a0 67 
                            65 52 c2 3e 3f 2c d0 9f 00 88 e2 6d 7c 14 e6 fa 
    Key material offset:    512
    AF stripes:             4000
Key Slot 2: DISABLED
Key Slot 3: DISABLED
Key Slot 4: DISABLED
Key Slot 5: DISABLED
Key Slot 6: DISABLED
Key Slot 7: DISABLED

Is there any hope of decrypting the drives?

What do you think could have done this? Windows messing with my drives, password amnesia, or something else?

EDIT: This forum post suggests a link between Samsung SSDs, and a discard flag in crypttab causing corruption: https://bbs.archlinux.org/viewtopic.php?pid=1846810#p1846810

Three of my LUKS partitions were on a Samsung EVO SSD. I can't confirm I wasn't using a discard flag in my crypttab.

EDIT: Hexdumps: https://mega.nz/#!QZxRDCzA!254HtfzHibAkJXcO6BcEZuoRpjLvQBXV7WjKYMgvbfs

Answer 1

The following is verbatim from the cryptsetup FAQ (emphasis mine):

I cannot unlock my LUKS container! What could be the problem?

First, make sure you have a correct passphrase.

Then make sure you have the correct key-map and correct keyboard.

And then make sure you have the correct character set and encoding, see also "PASSPHRASE CHARACTER SET" under Section 1.2.

If you are sure you are entering the passphrase right, there is the possibility that the respective key-slot has been damaged. There is no way to recover a damaged key-slot, except from a header backup (see Section 6).

For security reasons, there is also no checksum in the key-slots that could tell you whether a key-slot has been damaged. The only checksum present allows recognition of a correct passphrase, but that only works if the passphrase is correct and the respective key-slot is intact.

You questions

On to you questions...

Is there any hope of decrypting the drives?

You can only decrypt the drives with an intact LUKS header and the correct passphrase. Without those two requirements, I'm sorry but no, there's no hope of decrypting the drives; If there was LUKS would be worthless.

What do you think could have done this? Windows messing with my drives, password amnesia, or something else?

I can only speculate. Given none of the LUKS containers can be decrypted, and they all use the same password, I'm inclined to think it's an issue with the password.