Suppose I want an Ubuntu setup (let it be 12.04) with full disk encryption. Ubuntu offers this as an option during installation.
Suppose also that I have somebody (e.g. my vendor) else set this up for me and that I only get the finished system including the predefined encryption password (and of course all other passwords).
Is there any way that this person can reliably retain access to the encrypted data on the device even when I change the encryption password (and possibly other passwords)?
(Note that I'm not talking about normal backdoors like installing a SSH key or a root shell or patching some daemon to receive commands from outside. I am talking specifically about backdoors that target the full disk encryption and possibly cannot be closed without having to reinstall or re-encrypt the whole system.)
For example, with TrueCrypt it is (or was) possible to save the first sectors of an encrypted harddisk, because it only uses the password to encrypt the master key (which is then used to encrypt the data) - and if you replace both password and encrypted master key by replacing those sectors after a password change, you can practically undo an encryption password change.
Is something like this possible with dm-crypt/LUKS? If not, anything similar?