0

I've got a situation where disk encryption password has been compromised and now am in a situation where I need to re-encrypt the hdd with a different password.

It's a standard debian full disk encryption setup. I've got a carbon copy spare disk of the one that requires re-encryption.

What would be the easiest way to do it?

Thanks!

Tom
  • 1
  • 1

1 Answers1

1

I'm assuming you are using dm-crypt and LUKS. If that is the case, then you can add a new password, and then delete the old one.

In this setup, you are not changing the actual encryption key, you are just changing the password that encrypts (locks) the encryption key. With Luks you can have multiple passwords set that can decrypt (unlock) the disk encryption key.

To be a bit more descriptive, you would do the following (or similar):

sudo cryptsetup luksAddKey /location/to/encrypted/device
<<enter a new password>>    # Once completed, it should tell you which slot the
                            # new key was added to.
sudo cryptsetup luksKillSlot /location/to/encrypted/device <<slot number of old key>>
Phanto
  • 891
  • 5
  • 16
  • 24