3

first of all I already read this topic : How to change the hash-spec and iter-time of an existing dm-crypt LUKS device?

where the proposal is the following command :

cryptsetup-reencrypt --keep-key

However, the answer is 7 years ago and was considered as experimental. On my side, I have installed Debian from a live USB ticking on encrypt Disk during install. So when I boot my device, I have to decrypt directly from grub. It takes too long to decrypt because it seems that default --iter-time is around 30 seconds even if my password is correct, therefore some people propose to reduce --iter-time to 300.

This is why I have additional questions :

  1. Is cryptsetup-reencrypt --keep-key -iter-time DEVICE the exact correct code today ?
  2. The partition which has Luks over it is /dev/nvme0n1p2 and the luks partition is /dev/mapper/luks-xxxx, there is also the same for the swap partition. Which device to chose : cryptsetup-reencrypt --keep-key -iter-time /dev/nvme0n1p2 or cryptsetup-reencrypt --keep-key -iter-time /dev/mapper/luks-xxxx ?
  3. Shall I use it from command in grub menu or from a live USB ?
  4. Is it formatting my data ? (better asking twice)

Thank you very much.

FYI :

  • OS : Debian
  • Way of installing Luks : by live USB (just ticking "encrypt disk")
  • LUKS version : LUKS 1
  • SLOTS : Key Slots 0 & 1 enabled, key slots 2 to 7 disabled
2
  • Grub is slower than cryptsetup can't really help it if you don't provide unencrypted /boot... LUKS 1 or LUKS 2? cryptsetup luksDump? Feb 10, 2022 at 23:15
  • Hello, I have edited my first post so you can see which luks I use. Please, feel free to help me, thank you very much ! Feb 11, 2022 at 20:45

1 Answer 1

4

You don't need to reencrypt the device if you want to change only --iter-time. Reencryption is used when you want to change the way the data on the disk is encrypted (so different key, algorithm or, in case of the linked question, hash function). Iteration time is a "property" of the key slot -- it tells how long should PBKDF2 take when derivating the key from your passphrase. To change it you need to change only the key slot property with

cryptsetup luksChangeKey /dev/nvme0n1p2 --iter-time <time in ms>

It will ask for passphrase and change properties of key slot with that passphrase, it is possible to select key slot for the operation with --key-slot (if you have same passphrase for multiple key slots). You'll need to repeat this if you want to change the iteration time for both key slots.

(This will also ask you to change your password, you can just reuse your old one, luksConvertKey which only changes the parameters doesn't work with LUKS 1.)

You can check the result with cryptsetup luksDump /dev/nvme0n1p2 you should see the number PBKDF iterations decreased.

2
  • 1
    Thank you very much Vojtech Trefny, this worked ! For other people like me, please note that it worked the second try, not the first one (I have 2 slots, therefore, I imagine Luks has decreased the wrong one the first time). Feb 13, 2022 at 9:54
  • also, please note that I have tried to upvote but I don't have enough reputation to do so, I am really sorry for that (I have marked the answer as solved anyway), I hope other people will upvote your kindness ! Feb 13, 2022 at 9:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .