1

I followed instructions on Speeding up LUKS decryption in GRUB - GRUB/Tips and tricks - ArchWiki. And I created Full Disk Encryption using the guide: Full_Disk_Encryption_Howto_2019 - Community Help Wiki.

I want to decrease the iterations for my encrypted boot partition:

$ sudo cryptsetup luksDump /dev/nvme0n1p1 
LUKS header information for /dev/nvme0n1p1

Version:        1
Cipher name:    aes
Cipher mode:    xts-plain64
Hash spec:      sha256
Payload offset: 4096
MK bits:        512
MK digest:      ec 22 27 de c1 ef 40 0f a5 cf 37 d3 96 5c d5 b2 6e c8 dd 90 
MK salt:        62 1a 05 81 ba 60 3b 0d b1 8a 9f f0 04 98 27 54 
                06 b6 8d 72 53 23 09 47 ea 5f 80 1d d7 c5 ca 50 
MK iterations:  305173
UUID:           586de9a0-14c7-40d7-b721-7fdba2e3b184

Key Slot 0: DISABLED
Key Slot 1: ENABLED
        Iterations:             4882774
        Salt:                   2a 22 d6 07 a3 48 ad 83 f9 f4 03 a4 a1 e7 95 ab 
                                2c 95 82 cf c1 73 99 1c 74 70 00 5b b8 1b bf 5f 
        Key material offset:    512
        AF stripes:             4000
Key Slot 2: ENABLED
        Iterations:             4888466
        Salt:                   65 fe 32 1d c4 c6 1b 38 28 4c 19 3c c0 27 5a d9 
                                83 92 13 8e f4 84 61 00 b5 f6 6c f8 75 15 36 52 
        Key material offset:    1016
        AF stripes:             4000
Key Slot 3: ENABLED
        Iterations:             4888466
        Salt:                   ce 5b b3 e1 f4 85 45 db fd 49 79 71 b1 02 c7 dc 
                                d7 60 a6 36 8b 82 95 20 8e 6e 1d ce 2b 35 1b 13 
        Key material offset:    1520
        AF stripes:             4000
Key Slot 4: DISABLED
Key Slot 5: DISABLED
Key Slot 6: DISABLED
Key Slot 7: DISABLED

We can see that 3 slots are enabled.

Changing the number of iterations

$ sudo cryptsetup luksChangeKey --pbkdf-force-iterations 1000   /dev/nvme0n1p1
Enter passphrase to be changed: 
Enter new passphrase: 
Verify passphrase: 
$ sudo cryptsetup luksDump /dev/nvme0n1p1 
LUKS header information for /dev/nvme0n1p1

Version:        1
Cipher name:    aes
Cipher mode:    xts-plain64
Hash spec:      sha256
Payload offset: 4096
MK bits:        512
MK digest:      ec 22 27 de c1 ef 40 0f a5 cf 37 d3 96 5c d5 b2 6e c8 dd 90 
MK salt:        62 1a 05 81 ba 60 3b 0d b1 8a 9f f0 04 98 27 54 
                06 b6 8d 72 53 23 09 47 ea 5f 80 1d d7 c5 ca 50 
MK iterations:  305173
UUID:           586de9a0-14c7-40d7-b721-7fdba2e3b184

Key Slot 0: ENABLED
        Iterations:             4888466
        Salt:                   93 c2 c4 fe 95 ab 24 44 9e dd 26 90 c1 cf a2 66 
                                19 80 d3 4b f9 e8 b3 5a 0e a1 9f 6a de d8 60 ea 
        Key material offset:    8
        AF stripes:             4000
Key Slot 1: ENABLED
        Iterations:             4882774
        Salt:                   2a 22 d6 07 a3 48 ad 83 f9 f4 03 a4 a1 e7 95 ab 
                                2c 95 82 cf c1 73 99 1c 74 70 00 5b b8 1b bf 5f 
        Key material offset:    512
        AF stripes:             4000
Key Slot 2: ENABLED
        Iterations:             1000
        Salt:                   65 fe 32 1d c4 c6 1b 38 28 4c 19 3c c0 27 5a d9 
                                83 92 13 8e f4 84 61 00 b5 f6 6c f8 75 15 36 52 
        Key material offset:    1016
        AF stripes:             4000
Key Slot 3: DISABLED
Key Slot 4: DISABLED
Key Slot 5: DISABLED
Key Slot 6: DISABLED
Key Slot 7: DISABLED

Questions

  1. After changing the number of iterations, we can see that previously keyslot 0 was disabled and not it has got enabled. Is it a random assignment of key slots? Is that important?
  2. To speed up the boot, do I require to decrease the iterations of all keyslot to 1000? As, I remember key slots are checked sequentially.
  3. How can I make iterations as 1000 for all key slots?
  4. Is the information displayed by above commands private and should not be shared?

2 Answers 2

2

(1.) cryptsetup swaps keyslots around for internal reasons, unfortunately you just have to deal with it.

From the cryptsetup luksChangeKey manpage:

If a key-slot is specified (via --key-slot), the passphrase for that key-slot must be given and the new passphrase will overwrite the specified key-slot.

If no key-slot is specified and there is still a free key-slot, then the new passphrase will be put into a free key-slot before the key-slot containing the old passphrase is purged.

If there is no free key-slot, then the key-slot with the old passphrase is overwritten directly.

It also mentions one of the reasons why it prefers to shuffle the keyslots around:

WARNING: If a key-slot is overwritten, a media failure during this operation can cause the overwrite to fail after the old passphrase has been wiped and make the LUKS container inaccessible.

Some cryptsetup commands let you specify the keyslot to be used, e.g. you can remove a specific slot or add a new key to a specific free slot. So there are various ways to get the keys in the order you want.

(2.) It's preferable to put the key you most often use into the first slot. Otherwise the slow slots will be tried first. It's also possible to specify the desired keyslot on cryptsetup open, but GRUB probably doesn't support it.

For LUKS 2, the keys are also not tried in keyslot order at all. Instead it depends on the order stored in the JSON metadata, as well as a keyslot priority you can set with cryptsetup config --priority, but I don't know if GRUB would honor that.

(3.) By changing each of them, or otherwise by removing the offending ones. (Consider making a backup of the LUKS header before removing keys, as it's possible to lock yourself out this way.)

(4.) It's not possible to derive a LUKS master key or passphrase from luksDump output as the key material is missing entirely. But if you lose this drive somewhere and whoever found it googles the UUID, they might find your post and identify you this way…

0

Each slot corresponds to a specific pass phrase

You can see which slot corresponds to your passphrase by using parameter --test-passphrase

You can then use -S to target a specific slot

some more info here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.