[dm-crypt] Major Problem with luksAddKey

[dm-crypt] Major Problem with luksAddKey

[Rookcifer]

I am using LUKS/dm-crypt to encrypt a storage drive I have (sdb).  I
wanted to change the LUKS passphrase on this volume, so I ran the
following command:

cryptsetup luksAddKey /dev/sdb1

I was prompted for my passphrase and slot 0 was unlocked.  Then I went
to enter the new passphrases, so I entered it and was asked to verify.
I entered it again.  It gave me a prompt that the passwords did not
match.  No big deal, right?  I must have mistyped.  So I went through
the process again, but this time I was not able to unlock the master
key!  I am now locked out of my volume completely and I have no idea
what to do.

Is this a bug or did I do something wrong?  I should not be locked out
of my volume after failing to change the pass phrase!

-- 
--Waiting on ECC

Re: [dm-crypt] Major Problem with luksAddKey

[Milan Broz]

On 03/09/2011 03:12 AM, Rookcifer wrote:
> I am using LUKS/dm-crypt to encrypt a storage drive I have (sdb).  I
> wanted to change the LUKS passphrase on this volume, so I ran the
> following command:
> 
> cryptsetup luksAddKey /dev/sdb1
> 
> I was prompted for my passphrase and slot 0 was unlocked.  Then I went
> to enter the new passphrases, so I entered it and was asked to verify.
> I entered it again.  It gave me a prompt that the passwords did not
> match.  No big deal, right?  I must have mistyped.  So I went through
> the process again, but this time I was not able to unlock the master
> key!  I am now locked out of my volume completely and I have no idea
> what to do.
> 
> Is this a bug or did I do something wrong?  I should not be locked out
> of my volume after failing to change the pass phrase!

Of course it should work. But you have not specified important info:

cryptsetup version? cryptsetup with the --debug output? which distro?
some erors in syslog? (io errors?)

if it is broken now, also luksDump of the partition.

cryptsetup should never touch original keyslot area, so even if
adding new fails, the old must always stay the same.

Milan

Re: [dm-crypt] Major Problem with luksAddKey

[Jonas Meurer]

[-- Attachment #1: Type: text/plain, Size: 1055 bytes --]

Hello,

On 08/03/2011 Rookcifer wrote:
> I am using LUKS/dm-crypt to encrypt a storage drive I have (sdb).  I
> wanted to change the LUKS passphrase on this volume, so I ran the
> following command:
> 
> cryptsetup luksAddKey /dev/sdb1
> 
> I was prompted for my passphrase and slot 0 was unlocked.  Then I went
> to enter the new passphrases, so I entered it and was asked to verify.
> I entered it again.  It gave me a prompt that the passwords did not
> match.  No big deal, right?  I must have mistyped.  So I went through
> the process again, but this time I was not able to unlock the master
> key!  I am now locked out of my volume completely and I have no idea
> what to do.

Maybe the reason is as simple as the Caps Lock key pressed by incident?

greetings,
 jonas

> Is this a bug or did I do something wrong?  I should not be locked out
> of my volume after failing to change the pass phrase!

For me, luksAddKey works as expected with cryptsetup 1.0.2. Which
version of cryptsetup do you use?

greetings,
 jonas

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 836 bytes --]