Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've got a situation where disk encryption password has been compromised and now am in a situation where I need to re-encrypt the hdd with a different password.

It's a standard debian full disk encryption setup. I've got a carbon copy spare disk of the one that requires re-encryption.

What would be the easiest way to do it?


share|improve this question

I'm assuming you are using dm-crypt and LUKS. If that is the case, then you can add a new password, and then delete the old one.

In this setup, you are not changing the actual encryption key, you are just changing the password that encrypts (locks) the encryption key. With Luks you can have multiple passwords set that can decrypt (unlock) the disk encryption key.

To be a bit more descriptive, you would do the following (or similar):

sudo cryptsetup luksAddKey /location/to/encrypted/device
<<enter a new password>>    # Once completed, it should tell you which slot the
                            # new key was added to.
sudo cryptsetup luksKillSlot /location/to/encrypted/device <<slot number of old key>>
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.