How to modify -iter-time on a existing luks partition

Question

first of all I already read this topic : How to change the hash-spec and iter-time of an existing dm-crypt LUKS device?

where the proposal is the following command :

cryptsetup-reencrypt --keep-key

However, the answer is 7 years ago and was considered as experimental. On my side, I have installed Debian from a live USB ticking on encrypt Disk during install. So when I boot my device, I have to decrypt directly from grub. It takes too long to decrypt because it seems that default --iter-time is around 30 seconds even if my password is correct, therefore some people propose to reduce --iter-time to 300.

This is why I have additional questions :

1. Is cryptsetup-reencrypt --keep-key -iter-time DEVICE the exact correct code today ?
2. The partition which has Luks over it is /dev/nvme0n1p2 and the luks partition is /dev/mapper/luks-xxxx, there is also the same for the swap partition. Which device to chose : cryptsetup-reencrypt --keep-key -iter-time /dev/nvme0n1p2 or cryptsetup-reencrypt --keep-key -iter-time /dev/mapper/luks-xxxx ?
3. Shall I use it from command in grub menu or from a live USB ?
4. Is it formatting my data ? (better asking twice)

Thank you very much.

FYI :

• OS : Debian
• Way of installing Luks : by live USB (just ticking "encrypt disk")
• LUKS version : LUKS 1
• SLOTS : Key Slots 0 & 1 enabled, key slots 2 to 7 disabled

Answer 1

You don't need to reencrypt the device if you want to change only --iter-time. Reencryption is used when you want to change the way the data on the disk is encrypted (so different key, algorithm or, in case of the linked question, hash function). Iteration time is a "property" of the key slot -- it tells how long should PBKDF2 take when derivating the key from your passphrase. To change it you need to change only the key slot property with

cryptsetup luksChangeKey /dev/nvme0n1p2 --iter-time <time in ms>

It will ask for passphrase and change properties of key slot with that passphrase, it is possible to select key slot for the operation with --key-slot (if you have same passphrase for multiple key slots). You'll need to repeat this if you want to change the iteration time for both key slots.

(This will also ask you to change your password, you can just reuse your old one, luksConvertKey which only changes the parameters doesn't work with LUKS 1.)

You can check the result with cryptsetup luksDump /dev/nvme0n1p2 you should see the number PBKDF iterations decreased.