I have an Ubuntu 22.04 system and need to change the LUKS encryption key and re-encrypt the data. This is the root filesystem, so I can't unmount it, and I don't have physical access to boot a live system. Like many standard full-disk encryption setups, `/dev/mmcblk0p3' is encrypted with LUKS and contains a LVM with a filesystem in it.

Based on the LUKS release notes, it is my understanding that after version 2.2.0 this feature exists (online re-encryption), yet on version 2.4.3 I can't get it to work.

If I use the command sudo cryptsetup-reencrypt /dev/mmcblk0p3 I get the error Cannot exclusively open /dev/mmcblk0p3, device in use. Some copies of documentation I've found suggest the argument --force-offline-encryption could be used, but my cryptsetup command doesn't recognize it.

How do I work around this error?

1 Answer 1


I solved this by using sudo cryptsetup reencrypt /dev/mmcblk0p3 instead of sudo cryptsetup-reencrypt /dev/mmcblk0p3. I don't know why that works, but it does.

  • 1
    See issue 498: gitlab.com/cryptsetup/cryptsetup/-/issues/498 . These are two different tools, the one failing is probably deprecated. "I'm aware it's a bit confusing currently when we ship both new LUKS2 reencryption code in cryptsetup and older cryptsetup-reencrypt utility for both LUKS1 and LUKS2 formats [...] cryptsetup-reencrypt binary will disappear or remain as alias/symlink only"
    – A.B
    Commented Sep 30, 2023 at 10:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .