I have a master key for an encrypted partition on a machine that I have SSH + root access to. I don't have access to any of the passphrases associated with the partition. Is there a way that I can verify that the master key is valid for that partition?

I can't unmount the partition as it is the root partition for the machine, so I don't think I can use luksOpen for example.

  • 1
    Should be enough to compare the key to the output of dmsetup table --showkeys – Hauke Laging Jun 4 '20 at 12:05

Like @HaukeLaging said, dmsetup table --showkeys might show the master key of a still open LUKS container (might not work for LUKS2 containers, see also 6.10 How do I recover the master key from a mapped LUKS1 container?).

You could copy like the first 128M of the device then experiment with it at home.

ssh root@server head -c 128M /dev/sdxy > sdxy.img

Possible experiment:

hexedit master.key     # hexedit or xxd -r -p to produce binary file
hexdump -C master.key  # to verify correctness

cryptsetup luksAddKey --master-key-file master.key sdxy.img
cryptsetup luksOpen sdxy.img luksxy
file -sL /dev/mapper/luksxy

If you get random data instead of a known filesystem or LVM header, it was the wrong key or there is some other problem with the LUKS header.

You can run the same experiment on the server directly, but there may be possible side effects with another device / duplicate UUIDs appearing etc. so it's better to do it on a separate machine or inside VM.

If the LUKS header is damaged so luksAddKey doesn't work, you can also luksFormat a new one. However in that case in addition to the master key, you also must specify the correct cipher and data offsets.

However, if you have any doubts regarding this LUKS container, you should backup all your files while the machine is still running. Storing the master key all over the place also circumvents the LUKS security concept, so it's best to make a new LUKS container with new master key from scratch.

  • I think copying the first X Mb of the device is my option here. My guess is that I won't need quite that much data (might need to transfer over slow connection!), but I'll do some experimentation on a local drive first to see how much data I need to verify a key. Cheers. – Slicedpan Jun 4 '20 at 15:20

Not the answer you're looking for? Browse other questions tagged or ask your own question.