Re: Problem after converting to LUKS2

On 2023-11-15 10:04, Milan Broz wrote:
> On 11/15/23 15:47, Anton Avramov wrote:
>> Hi,
>>
>> I have 3 partitions encrypted years ago with LUKS1.
>> I've decided to migrate them to LUKS2 and the first 2 there was no
>> problem, but the last I can open it anymore after the conversion.
>>
>> I've been using key-files for all of them, so there is no wrong password
>> input issue.
>>
>> The bad think is I don't have a header backup before the conversion (Yes
>> I know! Lessen learned!)
>
> Users either do not read warnings or just ignore them... :-)
>
>> I've tried different things like converting back to luks1 and header
>> repair but to no avail.
>
> And you tried this without backup too, I guess...
>
> Which cryptsetup version was used for conversion?
cryptsetup 2.4.3
>
>> As a last resort I'm writing here for help. Is there anything I can try
>> to at least read the partition?
>
> Please post log from failing command (luksOpen?) with --debug option, 
> so we can see what
> is failing and what exact version (toolss, kernel) you are using.
Ubuntu 22.04.3 LTS

Linux  5.15.0-88-generic #98-Ubuntu SMP Mon Oct 2 15:18:56 UTC 2023 
x86_64 x86_64 x86_64 GNU/Linux

# cryptsetup 2.4.3 processing "cryptsetup luksOpen --key-file 
/root/.luks/.p2pool.keyfile /dev/sda1 CryptP2Pool --debug"
# Running command open.
# Locking memory.
# Installing SIGINT/SIGTERM handler.
# Unblocking interruption on signal.
# Allocating context for crypt device /dev/sda1.
# Trying to open and read device /dev/sda1 with direct-io.
# Initialising device-mapper backend library.
# Trying to load any crypt type from device /dev/sda1.
# Crypto backend (OpenSSL 3.0.2 15 Mar 2022 [default][legacy]) 
initialized in cryptsetup library version 2.4.3.
# Detected kernel Linux 5.15.0-88-generic x86_64.
# Loading LUKS2 header (repair disabled).
# Acquiring read lock for device /dev/sda1.
# Opening lock resource file /run/cryptsetup/L_8:1
# Verifying lock handle for /dev/sda1.
# Device /dev/sda1 READ lock taken.
# Trying to read primary LUKS2 header at offset 0x0.
# Opening locked device /dev/sda1
# Verifying locked device handle (bdev)
# LUKS2 header version 2 of size 16384 bytes, checksum sha256.
# 
Checksum:7f72b2a6318880d0a698c23f7e04202139ea7c1c165633778507a58ff600af13 
(on-disk)
# 
Checksum:7f72b2a6318880d0a698c23f7e04202139ea7c1c165633778507a58ff600af13 
(in-memory)
# Trying to read secondary LUKS2 header at offset 0x4000.
# Reusing open ro fd on device /dev/sda1
# LUKS2 header version 2 of size 16384 bytes, checksum sha256.
# 
Checksum:b51c668d3b315ec1b1413023f8e0434171712520f3d8e7cf61c6a70bd6a8e5e4 
(on-disk)
# 
Checksum:b51c668d3b315ec1b1413023f8e0434171712520f3d8e7cf61c6a70bd6a8e5e4 
(in-memory)
# Device size 256059113472, offset 2097152.
# Device /dev/sda1 READ lock released.
# PBKDF argon2id, time_ms 2000 (iterations 0), max_memory_kb 1048576, 
parallel_threads 4.
# Activating volume CryptP2Pool using token (any type) -1.
# dm version   [ opencount flush ]   [16384] (*1)
# dm versions   [ opencount flush ]   [16384] (*1)
# Detected dm-ioctl version 4.45.0.
# Detected dm-crypt version 1.23.0.
# Device-mapper backend running with UDEV support enabled.
# dm status CryptP2Pool  [ opencount noflush ]   [16384] (*1)
No usable token is available.
# File descriptor passphrase entry requested.
# Activating volume CryptP2Pool [keyslot -1] using passphrase.
# dm versions   [ opencount flush ]   [16384] (*1)
# dm status CryptP2Pool  [ opencount noflush ]   [16384] (*1)
# Keyslot 0 priority 1 != 2 (required), skipped.
# Keyslot 1 priority 1 != 2 (required), skipped.
# Trying to open LUKS2 keyslot 0.
# Running keyslot key derivation.
# Reading keyslot area [0x8000].
# Acquiring read lock for device /dev/sda1.
# Opening lock resource file /run/cryptsetup/L_8:1
# Verifying lock handle for /dev/sda1.
# Device /dev/sda1 READ lock taken.
# Reusing open ro fd on device /dev/sda1
# Device /dev/sda1 READ lock released.
# Verifying key from keyslot 0, digest 0.
# Digest 0 (pbkdf2) verify failed with -1.
# Trying to open LUKS2 keyslot 1.
# Running keyslot key derivation.
# Reading keyslot area [0x28000].
# Acquiring read lock for device /dev/sda1.
# Opening lock resource file /run/cryptsetup/L_8:1
# Verifying lock handle for /dev/sda1.
# Device /dev/sda1 READ lock taken.
# Reusing open ro fd on device /dev/sda1
# Device /dev/sda1 READ lock released.
# Verifying key from keyslot 1, digest 0.
# Digest 0 (pbkdf2) verify failed with -1.
No key available with this passphrase.
# Releasing crypt device /dev/sda1 context.
# Releasing device-mapper backend.
# Closing read only fd for /dev/sda1.
# Unlocking memory.
Command failed with code -2 (no permission or bad passphrase).

>
> It can be trivial issue, but also something that cannot be recovered - 
> without
> logs nobody can say what's the problem.
>
> If some devices were converted correctly - what is the difference from 
> the failing one?
I did the first with a live ubuntu usb drive since 1 was the root.

The failed one I did after booting and dismounting and closing it.

Another difference is the others are mdadm raids where this one doesn't 
have raid.

>
> Milan
Thank you for your time and effort