reencryption with multi keyslots in batch mode
Frederic Hoerni <[email protected]> Wed, 3 Jun 2026 14:43:22 +0200
| Newsgroups | dev.linux.lists.cryptsetup |
|---|---|
| Message-ID | <[email protected]> |
Hello,
If we want to reencrypt a disk that has several keyslots (main and
recovery keyslots), I believe the only way is to do it in interactive mode.
But in some cases, we would like to do this in batch mode. We could
imagine a scenario like this:
1. Setup of the use case (no modification of cryptsetup needed so far)
# Initialize LUKS container
dd if=/dev/zero count=200 of=disk.img bs=1M
echo 0000 | sudo cryptsetup luksFormat --keyfile-size 4 \
--key-file - \
disk.img
# Add two keyslots
echo -n 0000x111111 | cryptsetup luksAddKey --key-file - \
--keyfile-size 4 \
disk.img
echo -n 0000222 | cryptsetup luksAddKey --key-file - \
--keyfile-size 4 \
disk.img
2. Reencryption (this step needs modification of cryptsetup)
echo -n 0000x111111222 | \
sudo cryptsetup reencrypt --key-file - \
--keypipe-sizes "4,7,3" \
--batch-mode \
--force-offline-reencrypt \
disk.img
3. Verify all keyslots
for passphrase in 0000 x111111 222; do
echo -n $passphrase | cryptsetup open disk.img --test-passphrase \
--key-file -
done
Do you have any on-going work in this direction?
Are you open to contribution for that? (I already have a proof of
concept for the above scenario)
Do you have any particular caveat about developing this feature?
Thank you
Frederic