Re: Password hash as LUKS key

On 15 Mar 2023 15:11 +0000, from [email protected] (Martin Olsson):
> I see maybe it's something wrong with the way I'm going about this. The following
> are the commands I'm running:
> 
> mkpasswd (asks me to enter a password, I enter test)
> Password:
> $y$j9T$35ITJ7yCc3kFUsasf3QDa/$n.HqacKYHPIEE6VxIHhT2vW8.7vfh.fn008SQS5ETb9
> 
> printf "%s\n%s\n%s\n" "12345" "$y$j9T$35ITJ7yCc3kFUsasf3QDa/$n.HqacKYHPIEE6VxIHhT2vW8.7vfh.fn008SQS5ETb9"| sudo /sbin/cryptsetup luksAddKey /dev/sda3

Aside from that already mentioned by Grzegorz Szymaszek, a more
general question: what leads you to believe that you can give the
output from mkpasswd (which at least on Debian is provided by the
"whois" package) to cryptsetup (provided by the "cryptsetup-bin"
package) and have the mkpasswd output be recognized by cryptsetup as
being somehow special?

A quick web search for the two didn't reveal anything obvious
connecting the two; and the cryptsetup man page does not mention
mkpasswd.

When I try what you're doing on my system, there is no indication that
cryptsetup recognizes the $y$j... string as in any way special; in
fact, quite the opposite. I also don't see why cryptsetup _should_
recognize it as being somehow special, as you are just providing a
string to the luksAddKey operation to use as a keyslot passphrase.

Example:

# truncate -s 1G ~/tmpluks
# losetup -f --show ~/tmpluks
/dev/loop0
# cryptsetup luksFormat /dev/loop0
...
Enter passphrase for /root/tmpluks: <enter 12345>
Verify passphrase: <enter 12345>
# printf '%s\n%s\n%s\n' '12345' '$y$j9T$35ITJ7yCc3kFUsasf3QDa/$n.HqacKYHPIEE6VxIHhT2vW8.7vfh.fn008SQS5ETb9' | cryptsetup luksAddKey /dev/loop0
# cryptsetup luksOpen /dev/loop0 devloop0
Enter passphrase for /root/tmpluks: <enter 12345>
# cryptsetup luksClose devloop0
# cryptsetup luksOpen /dev/loop0 devloop0
Enter passphrase for /root/tmpluks: <enter test>
No key available with this passphrase.
Enter passphrase for /root/tmpluks: <enter $y$j...Tb9>
# cryptsetup luksClose devloop0
# losetup -D /dev/loop0
# rm ~/tmpluks 

-- 
Michael Kjörling                     🔗 https://michael.kjorling.se
“Remember when, on the Internet, nobody cared that you were a dog?”