Re: [dm-crypt] LUKS device failure after Cryptsetup upgrade

[Milan Broz <gmazyland@gmail.com>]

Hi,

We maintain strict backward compatibility, so there should be
no problem during any upgrade.

But you have apparently corrupted LUKS header here, reading from the debug log:

  # Invalid stripes count 1 in keyslot 4.
  LUKS keyslot 4 is invalid.

  LUKS keyslot 4 is invalid.
  Non standard keyslots alignment, manual repair required.

it seems there is some corruption in metadata area, but because
there is some non-standard data alignment, cryptsetup code will
*not* repair this automatically.

If the corruption is *only* in the unused keyslot metadata, this should
be easily recoverable, just automatic repair is not possible.
(But if the corruption is in the used keyslot area also, your data is lost!)

If you can send me (privately, not to the list) first 4096 bytes from your LUKS device LV
(this should contain only metadata, no private keyslot material), I can try to fix it.

Use dd (and send me luks.img file):
dd if=<your LUKS volume/LV> of=luks.img bs=4096 count=1 iflag=direct

In any case, be sure to backup existing LUKS header though!

(If not possible through cryptsetup because of invalid header, just dd first 4MB of disk area).

Milan

On 31/01/2021 17:48, Maxime Alves wrote:
> Hi,
> 
> I just upgraded my Gentoo distribution, and now I can't open my Luks-encrypted
> LMV volume. I spent almost a year without rebooting/upgrading and don't really
> know what could have caused this error.
> 
> Cryptsetup was upgraded from 2.2.1 to 2.3.2, but I did not reboot since it was
> version 1.7.5, so maybe I was still using the 1.7.5 through libvirt.
> 
> 
> Sadly, I did NOT backup before upgrading my Gentoo distro, thinking that there
> would be no big problem upgrading my system. The volume was unmounted, and is
> used only in a virtual machine ran by libvirt/kvm. I realized the device was
> not unlockable when I restarted my hypervisor and my VM.
> 
> I tried to use a SystemRescue iso to open the device, with cryptsetup 1.7.x . I
> could repair the volume, but after that impossible to open it with my old
> passphrase.
> 
> Thanks for reading,
> Maxime
> 
> 
> Here are some informations I gathered after the advices of some people of
> #gentoo.
> 
> 
> _______________________________________________
> dm-crypt mailing list
> dm-crypt@saout.de
> https://www.saout.de/mailman/listinfo/dm-crypt
> 
_______________________________________________
dm-crypt mailing list
dm-crypt@saout.de
https://www.saout.de/mailman/listinfo/dm-crypt