35

I have a luks-encrypted partition that was protected by a passphrase and a key file. The key file was for routine access and the passphrase was in a sealed envelope for emergencies. May months went by and I accidentally shredded the key file, so I recovered by using the passphrase from the envelope. Now I want to know, I have two active key slots but I don't know which contains the useless key file pass phrase and which has my emergency passphrase in it. Obviously if I remove the wrong one I'll lose all the data on the drive.

#cryptsetup luksDump /dev/sda2
LUKS header information for /dev/sda2

Version:        1
Cipher name:    aes
Cipher mode:    xts-plain64
Hash spec:      sha256
Payload offset: 4096
MK bits:        256
MK digest:      xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx 
MK salt:        xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx 
                xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx 
MK iterations:  371000
UUID:           28c39f66-dcc3-4488-bd54-11ba239f7e68

Key Slot 0: ENABLED
        Iterations:             2968115
        Salt:                   xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx 
                                xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx 
        Key material offset:    8
        AF stripes:             4000
Key Slot 1: ENABLED
        Iterations:             2968115
        Salt:                   xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx 
                                xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx 
        Key material offset:    264
        AF stripes:             4000
Key Slot 2: DISABLED
Key Slot 3: DISABLED
Key Slot 4: DISABLED
Key Slot 5: DISABLED
Key Slot 6: DISABLED
Key Slot 7: DISABLED
Huckle
  • 975
  • 2
  • 8
  • 30
  • 7
    Turns out that `luksKillSlot` asks for a passphrase from another slot, so there's no risk in destroying the last key you have. However, I believe the original question is still valid. – Huckle Oct 23 '16 at 22:16

2 Answers2

34

As you've discovered, you can use cryptsetup luksDump to see which key slots have keys.

You can check the passphrase for a particular slot with

cryptsetup luksOpen --test-passphrase --key-slot 0 /dev/sda2 && echo correct

This succeeds if you enter the correct passphrase for key slot 0 and fails otherwise (including if the passphrase is correct for some other key slot).

If you've forgotten one of the passphrases then you can only find which slot it's in by elimination, and if you've forgotten two of the passphrases then there's no way to tell which is which (otherwise the passphrase hash would be broken).

To remove the passphrase you've forgotten, you can safely run cryptsetup luksKillSlot /dev/sda2 0 and enter the passphrase you remember. To wipe a key slot, cryptsetup requires the passphrase for a different key slot, at least when it isn't running in batch mode (i.e. no --batch-mode, --key-file=- or equivalent option).

Gilles 'SO- stop being evil'
  • 807,993
  • 194
  • 1,674
  • 2,175
21

A simpler way (now?) is to use the command with the --verbose option but without specifying the --key-slot one:

# cryptsetup --verbose open --test-passphrase /dev/sda2
Enter passphrase for /dev/sda2: 
Key slot 4 unlocked.

It will automatically check for you the right slot, without having you looping for finding the good one :)

ratnoz
  • 427
  • 3
  • 10