Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've got a situation where disk encryption password has been compromised and now am in a situation where I need to re-encrypt the hdd with a different password.

It's a standard debian full disk encryption setup. I've got a carbon copy spare disk of the one that requires re-encryption.

What would be the easiest way to do it?

Thanks!

share|improve this question
2  
add comment

1 Answer

I'm assuming you are using dm-crypt and LUKS. If that is the case, then you can add a new password, and then delete the old one.

In this setup, you are not changing the actual encryption key, you are just changing the password that encrypts (locks) the encryption key. With Luks you can have multiple passwords set that can decrypt (unlock) the disk encryption key.

To be a bit more descriptive, you would do the following (or similar):

sudo cryptsetup luksAddKey /location/to/encrypted/device
<<enter a new password>>    # Once completed, it should tell you which slot the
                            # new key was added to.
sudo cryptsetup luksKillSlot /location/to/encrypted/device <<slot number of old key>>
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.