4

I'm trying to find out what happened to my laptop LUKS drive. I'm sure it ran out of battery since I forgot to plug it in. This morning I booted the system and the LUKS password does not work. I tried several reboots and every time it ends up offering emergency console after 3 tries because it can't decrypt the drive.

My question is, if the laptop lost power and did not have time to suspend/sleep, can that corrupt the password? I had thought a power-off corruption would cause it to not ask for any password at all... corrupted, not just mess up password.

I tried decrypting the crypt volume while booted from live CD but it still fails. In this case would it still be worthwhile to try restore boot files?

6
  • 1
    In theory it should not corrupt as nothing writes to it. In practice, who knows what happened. Sometimes it's a different issue (botched update, wrong keyboard layout, ...) but then you would be able to open it from a Live CD with either us layout or your native layout. You can check hexdump -C for obvious corruption (non-random data where it should be random), not much other options... Dec 29, 2021 at 20:12
  • @frostschutz Thanks. Very interesting to actually look at the hexdump from the crypt vol. Starts with "LUKS..........@" and then down the way I see a "SKUL....." and then after that I see an FML. I hope someone didnt get root access and change it on me. Thanks for your responses though!
    – idonteven
    Dec 30, 2021 at 1:24
  • 2
    Be sure to backup before you make a mistake while trying to fix it.
    – Cyphase
    Dec 30, 2021 at 7:32
  • 1
    Silly question: how new is this LUKS encrypted drive? Have you ever successfully rebooted it at least twice? It's possible to create LUKS setups that will only work until the first reboot. Has happened to me several times - of course not using the installer, but goofing things up from the command line. Dec 30, 2021 at 8:13
  • Are you sure the keyboard is fully working? Can you try an external keyboard?
    – Boann
    Dec 30, 2021 at 13:28

3 Answers 3

10

LUKS works by dedicating a small amount of space, typically on the encrypted partition, to the "LUKS header". That header contains a checksum, so it should detect corruption. Further, there are two copies; each with their own checksum, so it should automatically use the other copy if one is corrupted. Along with the header, there is the keyslot data, which actually stores the encryption keys. That is not duplicated, I believe will at least detect corruption (and you could use a backup key/passphrase if you have one).

Documentation of the format can be found at https://gitlab.com/cryptsetup/LUKS2-docs/blob/master/luks2_doc_wip.pdf

So I think it's very unlikely the on-disk data got corrupted, and even more unlikely that doesn't get a corruption error instead of a wrong passphrase.

More likely, you're just entering the wrong passphrase — possibly you're using a different keyboard layout, had caps lock on, or you've forgotten it. If you have a backup recovery key, you can use that to recover your data.

(Side note, if it did get corrupted and you don't have a backup of the header + keyslots or the master key, the data is entirely unrecoverable).

Frostschutz points out that if you're still on the old LUKS1 format then there isn't a checksum, so corruption could occur (though there are still magic numbers, etc., so if the entire sector were overwritten that'd be noticed). Also, if you've upgraded from a very old cryptsetup/gcrypt (2014-era), then there was a bugfix which broke cryptsetup; see https://gitlab.com/cryptsetup/cryptsetup/-/wikis/FrequentlyAskedQuestions#8-issues-with-specific-versions-of-cryptsetup for details.

8
  • 3
    Though LUKS 2 has been around for a while now, many installs still use LUKS 1 and grub still doesn't support LUKS2/argon2 keys properly. So, LUKS 1 isn't going away and it doesn't have checksums or redundancy. It will just ask for pass and never unlock. @pleskymajor did not give much information to work with Dec 29, 2021 at 20:27
  • 2
    He's using Fedora which adopted LUKS2 in Fedora 30 released on April 30, 2019, more than two years ago while the current release is 35. Source: fedoraproject.org/wiki/Releases/30/… Dec 29, 2021 at 21:01
  • 1
    yeah, I guess this is a question about keyboartd layout, +1 on the reply
    – wuseman
    Dec 29, 2021 at 22:36
  • 1
    @idonteven, You would need root permissions to do that, so malware on windows could mess with your Linux drives, but if you are only running Linux it's very unlikely that it has been corrupted without the help of root level malware
    – Brandon
    Dec 30, 2021 at 10:42
  • 1
    @idonteven depends... did you try to change the password of a different LUKS volume? I could definitely see accidentally giving the wrong device name.
    – derobert
    Dec 30, 2021 at 11:09
5

My question is, if the laptop lost power and did not have time to suspend/sleep, can that corrupt the password?

It's extremely improbable. The LUKS header is normally never updated (written to) unless you change your password or reencrypt.

I had thought a power-off corruption would cause it to not ask for any password at all... corrupted, not just mess up password.

I believe you've got your /boot files corrupted and your data is intact. Try to boot from rescue media and restore your Linux boots files which is distro specific.

I tried decrypting the crypt volume while booted from live CD but it still fails. In this case would it still be worthwhile to try restore boot files?

No, it won't help, most likely you've lost everything unfortunately. Probably something else has modified the security header.

3
  • @artem-s-tashkinov Thank you, I see. I tried decrypting the crypt volume while booted from live CD but it still fails. In this case would it still be worthwhile to try restore boot files?
    – idonteven
    Dec 30, 2021 at 0:49
  • @idonteven, if the live CD can't do it, copying files from the live CD won't either
    – Brandon
    Dec 30, 2021 at 10:38
  • 1
    I tried decrypting the crypt volume while booted from live CD but it still fails. - no, you've lost everything unfortunately. Probably something else has modified the security header. Dec 30, 2021 at 11:17
3

Things to check before you give up:

  1. Caps Lock / Num Lock / F lock of the laptop keyboard? Some laptops have "integrated numeric pad" that occupies letter keys or F keys that share with number keys. A battery completely depleted may have triggered a BIOS reset.

  2. Try external keyboard. The keyboards have their own controllers that misbehave in unexpected ways when mispowered, too.

2.1 try entering the password in a place where you see what you type (the place may be the emergency console). Does it look right?

  1. Try attaching the disk to known good computer.

  2. LiveCD having different LUKS version?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.