Lesson 3.40: LUKS key slots: who can unlock the disk
A LUKS2 volume has one data key and up to 32 key slots, each holding a copy of that key wrapped with a different passphrase or key file. Every slot is a way in, so the list of slots is an access list, and old slots outlive the people who set them. In the lab Northwind's database server has three slots: the admins' key, a legacy key from a 2019 migration with a weak key-derivation setting, and a recovery passphrase that belonged to a contractor who has left. You map each escrowed key to its slot, remove the contractor's slot, strengthen the legacy one, and back up the header.
18 min
You will learn to
- Explain the LUKS2 header, data key and key slots
- Read luksDump output
- Find which slot a key opens with --test-passphrase
- Remove and convert key slots
- Back up a LUKS header
Key terms
- LUKS
- Linux Unified Key Setup: the standard format for encrypted block devices, managed with cryptsetup.
- Volume key
- The key that actually encrypts the data; it never changes unless you re-encrypt.
- Key slot
- A copy of the volume key wrapped with one passphrase or key file; up to 32 in LUKS2.
- PBKDF
- The function that turns a passphrase into a wrapping key; argon2id is memory-hard, PBKDF2 is not.
- LUKS header
- The metadata and key slots at the start of the device; damage to it makes the data unrecoverable.
- Epoch
- A counter that increases with every header change.
← Reading and fixing SELinux denials · All lessons · CPU vulnerabilities and their mitigations →