Change Hash-Spec and Iter-Time of dm-crypt LUKS Device – How to Guide

dm-cryptluks

How can I change the hash-spec and iter-time of an existing dm-crypt LUKS device?

Clearly I can pass the options if I create a new device, for example something like this:

 sudo cryptsetup luksFormat --cipher aes-cbc-essiv:sha256 --key-size 256 --iter-time 2100 --hash sha512 /dev/loop0

But if the device already exists, how can I change for example sha256 to sha1 or change the iteration time without "destroying" the device. (Clearly you would have to retype your password since a new hash will be generated.)

Best Answer

Each key slot has its own iteration time. If you want to change the number of iterations, create a new slot with the same passphrase and a new number of iterations, then remove the old slot.

cryptsetup -i 100000 --key-slot 2 luksAddKey $device
cryptsetup luksKillSlot $device 1

I think the hash algorithm cannot be configured per slot, it's always PBKDF2 with a globally-chosen hash function.

Recent versions of cryptsetup include a tool cryptsetup-reencrypt, which can change the main encryption key and all the parameters, but it is considered experimental (and it reencrypts the whole device even though this would not be necessary to merely change the password-based key derivation function).

Related Question