Cryptsetup lost password but open device

Question

first, I know it is a very bad situtation and one should always have a backup of keys but the problem is not caused by me. I only was ask for help.

The drive is encrypted using cryptsetup with luks. The corresponding password got lost but the device is open (mounted). I tried to add a new key using luksAddKey but I have to enter an existing password at first.

Is there a way to get a new password to this device or do I have to copy all data to an extra drive and create a new encrypted device?

The system information are:

$ lsb_release -a                                                               
No LSB modules are available.
Distributor ID: Ubuntu
Description:    Ubuntu 16.04.3 LTS
Release:    16.04
Codename:   xenial

$ cryptsetup --version                                                         
cryptsetup 1.6.6

$ cryptsetup luksDump /dev/md2                                                 
LUKS header information for /dev/md2

Version:        1
Cipher name:    aes
Cipher mode:    xts-plain64
Hash spec:      sha512
Payload offset: 4096
MK bits:        512
MK digest:      37 ee 53 b6 13 86 93 2a 13 36 41 85 ab 26 e0 7f 7f 3e 03 be 
MK salt:        ed 4e 59 fc 3e b3 42 f2 32 97 c5 95 83 eb 90 6c 
                eb 40 02 25 85 db 5c d1 68 85 3a 54 a0 9d c9 f1 
MK iterations:  62875
UUID:           a9b56d9a-fb50-4b8a-ad63-af1851c89f42

Key Slot 0: ENABLED
    Iterations:             267782
    Salt:                   25 66 7e 35 aa 55 b2 05 c3 fc 66 89 e4 2c 5c b6 
                            e3 18 25 8e 66 d8 03 c5 24 d7 a1 09 15 dc ec 78 
    Key material offset:    8
    AF stripes:             4000
Key Slot 1: DISABLED
Key Slot 2: DISABLED
Key Slot 3: DISABLED
Key Slot 4: DISABLED
Key Slot 5: DISABLED
Key Slot 6: DISABLED
Key Slot 7: DISABLED

score 0 · Accepted Answer · answered Nov 26 '17 at 22:48

You can find a good solution at: http://www.thegeekstuff.com/2016/03/cryptsetup-lukskey/

Here is the short version:

dmsetup table  --showkeys|grep luks

Make sure you have only one encrypted device.

cryptsetup luksAddKey /dev/sdXX --master-key-file <(dmsetup table  --showkeys|grep luks|cut -d\  -f 6|xxd -r -p)

Please change /dev/sdXX with the block device where luks is on top.

Cryptsetup lost password but open device

1 Answers1