Cryptsetup/LUKS2 destroyed my data when I tried to remove encryption, Why?
I'm Using Cryptsetup 2.3.3. I was experimenting with LUKS (in a VM, thankfully)
and had an ext4 filesystem on a LUKS2 encrypted partition. I decided to
test out LUKS's ability to non-destructively remove encryption from a block device
I ran cryptsetup reencrypt --decrypt
and got an error I must pass in a header.
Since I do not use a detached header, I passed in the device so it can read the header
off of it. The decryption gave a "standard" warning:
WARNING!
========
Unable to decide if device /tmp/file is activated or not.
Are you sure you want to proceed with reencryption in offline mode?
It may lead to data corruption if the device is actually activated.
To run reencryption in online mode, use --active-name parameter instead.
and then procceded to decrypt without reporting any error... then the data was lost.
What I expected is for the ext4 system formerly inside the LUKS2 device to become
visible to the OS, just as if I'd formatted the partition with ext4 to begin with.
But blkid
still detected the partition as TYPE="crypto_LUKS"
.
I then tried to open the partition with luks, thinking it may have actually done nothing,
and the data was still there. But after entering the passphrase I got the error
Keyslot open failed.
No usable keyslot is available.
and luksDumps
showed no active keyslots.
Why did cryptsetup destroy my data?