first of all I already read this topic : How to change the hash-spec and iter-time of an existing dm-crypt LUKS device?
where the proposal is the following command :
cryptsetup-reencrypt --keep-key
However, the answer is 7 years ago and was considered as experimental. On my side, I have installed Debian from a live USB ticking on encrypt Disk during install. So when I boot my device, I have to decrypt directly from grub. It takes too long to decrypt because it seems that default --iter-time
is around 30 seconds even if my password is correct, therefore some people propose to reduce --iter-time
to 300
.
This is why I have additional questions :
- Is
cryptsetup-reencrypt --keep-key -iter-time DEVICE
the exact correct code today ? - The partition which has Luks over it is
/dev/nvme0n1p2
and the luks partition is/dev/mapper/luks-xxxx
, there is also the same for the swap partition. Which device to chose :cryptsetup-reencrypt --keep-key -iter-time /dev/nvme0n1p2
orcryptsetup-reencrypt --keep-key -iter-time /dev/mapper/luks-xxxx
? - Shall I use it from command in grub menu or from a live USB ?
- Is it formatting my data ? (better asking twice)
Thank you very much.
FYI :
- OS : Debian
- Way of installing Luks : by live USB (just ticking "encrypt disk")
- LUKS version : LUKS 1
- SLOTS : Key Slots 0 & 1 enabled, key slots 2 to 7 disabled
cryptsetup
can't really help it if you don't provide unencrypted/boot
... LUKS 1 or LUKS 2?cryptsetup luksDump
?