Change full disk encryption passphrase

English Install/Boot/Login
1

I would like to change my full disk encryption passphrase (to make it stronger). I’m kinda anxious - if something goes wrong then I won’t be able to get into my system again.

Can someone please verify whether the below steps I plan to carry out is correct?

Step 1. Get a list of disks and Partitions
sudo fdisk -l

Disk is /dev/nvme0n1

Partitions are
/dev/nvme0n1p1 EFI System
/dev/nvme0n1p2 Linux LVM

and a few /dev/mapper/…

Step 2. Find what is encrypted, disk or partition?
I went through the disk and partitions one by one until I found it.
sudo cryptsetup luksDump /dev/nvme0n1p2

Although /etc/crypttab points to a weird looking /dev/mapper/ when I try luksDump on this there is no encryption on it.

Step 3. Remove existing passphrase
sudo cryptsetup luksRemoveKey /dev/nvme0n1p2

Step 4. Add new passphrase
sudo cryptsetup luksAddKey /dev/nvme0n1p2

Step 5. Verify encryption
sudo cryptsetup luksDump /dev/nvme0n1p2

I noticed in Step 2 above only Slot 0 was used, i.e. only 1 passphrase.
Q. So if I add two passphrases (i.e. Slot 0 and Slot 1 enabled), does this mean at boot I will have to enter two passphrases?

2

When you remove the key, I think you lose all of the encrypted data.

If you want to keep the data, and just change the key, then use luksAddKey to add a new key. And you can then remove the old key, because the data is still accessible via the new key.

No. It means that either passphrase will work. You still only need to enter one.

3

Thank you very much @nrickert - that is a critically important point. Yes, I do want to keep my data - LOL!

For anyone else who plans to follow these steps: Swap steps 3 & 4 around - DO STEP 4 BEFORE STEP 3!

4

cryptsetup luksChangeKey

5

Thank you, I didn’t know about this Change command.
I’ve updated the passphrase successfully via an Add and Remove.

6

Actually, that is exactly what luksChangeKey does under the hood. The difference is that if you do not have free slot to perform luksAddKey, luksChangeKey will still work and overwrite existing slot in place.

7

Very good to know. Next time I will use ‘Change’. Thanks.