reencrypt: how to specify old and new key-files?
Philippe Cerfon <[email protected]>
| Newsgroups | dev.linux.lists.cryptsetup |
|---|---|
| Message-ID | <CAN+za=OaHi939USLRp8DttVjamBx7qSxOp-LPm6uNtMN7oek8A@mail.gmail.com> |
Hey. Sorry for having to ask again. When I'm reencrypting a device in order to change the volume key and also the keyslot (say from PBKDF2 to Argon2) wouldn't there need to be some way to specify two different --key-file? One for the old keyslot with the old VK, and one for the new keyslot to be generated? Especially if with --key-slot <old slot ID>, the old slot is overwritten and all others removed, as explained by the manpage: > For reencryption mode it selects specific keyslot (and passphrase) > that can be used to unlock new volume key. If used all other keyslots > get removed after reencryption operation is finished. But it seems there is only the --key-file option, for which it's even unclear to me, whether it's for the old or new keyslot/VK? Thanks, Philippe