can't mount LUKS partition with cryptsetup

Thorsten Giese <[email protected]> Tue, 19 Nov 2024 18:06:37 +0100
Newsgroups dev.linux.lists.cryptsetup
Organization Technische Universität Kaiserslautern
Message-ID <[email protected]>
Hello there,

tl;dr I have a Ubuntu on a NVME with encrypted root where I can boot the 
system with the correct passphrase but can not mount the partition in a 
live Liux with cryptsetup.

I have a weird problem and no clue where to go with it.
I try to keep it short and really hope someone can push me in the right 
direction.

I have a setup with an encrypted root partition from the Ubunut/Debian 
installer, 3 partitions nvme0n1p1 (BIOS boot, 1M), nvme0n1p2 (ext2, 
/boot, 1G) and nvme0n1p3 (LUKS, propably with LVM inside (I know lvscan)).

I had a rather long system freeze, and after that /boot was empty (no 
clue why) and I was at the grub rescue shell with no options. I ran 
multiple live-Linux-Distros (grml, ubuntu, ...) and read everywhere, 
that a dm-crypt Partition ist mountable with "cryptsetup open" (to get 
my data).

When presented with

Enter passphrase for /dev/nvme0n1p3:
No key available with this passphrase.

I thought the LUKS header might also be corrupted and just thought: bad 
luck.

root@foobar:~# cryptsetup luksDump /dev/nvme0n1p3
LUKS header information
Version:       	2
Epoch:         	3
Metadata area: 	16384 [bytes]
Keyslots area: 	16744448 [bytes]
UUID:          	18d1e37e-3960-4f86-82f2-231bee10d5f0
Label:         	(no label)
Subsystem:     	(no subsystem)
Flags:       	(no flags)

Data segments:
   0: crypt
	offset: 16777216 [bytes]
	length: (whole device)
	cipher: aes-xts-plain64
	sector: 512 [bytes]

Keyslots:
   0: luks2
	Key:        512 bits
	Priority:   normal
	Cipher:     aes-xts-plain64
	Cipher key: 512 bits
	PBKDF:      argon2i
	Time cost:  7
	Memory:     1048576
	Threads:    4
	Salt:       2d d6 9d 46 b8 84 10 d4 22 e9 d4 71 31 37 63 91
	            70 93 c4 01 87 b7 b2 ea 17 14 8f 9b 9b e9 40 1a
	AF stripes: 4000
	AF hash:    sha256
	Area offset:32768 [bytes]
	Area length:258048 [bytes]
	Digest ID:  0
Tokens:
Digests:
   0: pbkdf2
	Hash:       sha256
	Iterations: 140183
	Salt:       23 13 a0 eb 7d bd ab 94 e2 17 94 ea 35 cb 21 be
	            7f 6f 13 03 b3 7c 9f a5 0d 5d b7 aa 0c 95 98 0e
	Digest:     77 5e 1d 86 8d f9 ad 68 b2 b0 07 84 a9 d3 b4 14
	            fb 36 e3 3b 1b 12 bc 35 27 18 db b6 04 0a 9b 46

(UUID, Salt and Digest modified)

Now it gets interesting: when I set up originally the NVME had some 
strange errors and I thought it might be broken and ordered a new one. 
The new one had the same errors and I ended up to fix it with 
nvme_core.default_ps_max_latency_us=0. I put the first NVME aside as a 
spare part.

Now I wanted to install fresh on that NVME. I put it in my server and 
after entering the passphrase the system came up (proof: this NVME works 
AND I know the correct passphrase). I looked for any data.

Then I booted a live Linux to see if I could mount it with cryptsetup 
and got the same error message as with the "broken" NVME. Now I hope 
there is a way to get it to boot and recover my data. I read around and 
can't find any recent documentation for the process. I read (from 2023) 
that grub2 does not support argon2i also it is in my header, so maybe 
that is a clue or Ubuntu has a patched Version.

Before entering the passphrase it says something about 
/scripts/init-premount, maybe there is a hint on how to mount it, but I 
can't find it anywhere.

How can I mount a dm-crypt Volume from command line or how can I 
reinstall grub/boot without a system. I also tried supergrml to no success.

Thank you very much for your attention
kind regards
Thorsten