{
  "slug": "luks-keyslot",
  "term": "LUKS keyslot",
  "aliases": [],
  "definition": "A LUKS keyslot is a credential-protected key-management slot used to recover key material for encrypted storage.",
  "note": "Changing a passphrase updates its keyslot rather than necessarily changing the key that encrypts stored data. LUKS2 can also contain unbound keyslots, so a slot must not automatically be interpreted as an active data-segment key. [luks-change-v270] [luks-dump-v270]\n\nHesela's cryptsetup 2.7.0 LUKS1/LUKS2 experiment recovered an unchanged volume key after changing the live passphrase. An earlier header backup still accepted the old credential. These are controlled file observations, not a test of active mappings, reencryption or physical sanitization. [hesela-luks-observations]\n\nA slot is not a unique credential identity. The same passphrase can protect more than one slot. In Hesela's separate 144-check study, changing slot 0 left the old passphrase usable through slot 1; removing slot 1 stopped that live route. The recovered volume key stayed unchanged. [hesela-luks-slots]",
  "status": "shipping",
  "advantages": [],
  "limitations": [],
  "related": [
    "luks",
    "luks-header-backup",
    "dm-crypt",
    "cryptographic-erase"
  ],
  "supersedes": [],
  "supersededBy": [],
  "firstSeen": null,
  "lastSeen": null,
  "citations": [
    {
      "id": "luks-change-v270",
      "title": "cryptsetup v2.7.0: passphrase replacement",
      "url": "https://gitlab.com/cryptsetup/cryptsetup/-/raw/v2.7.0/man/cryptsetup-luksChangeKey.8.adoc",
      "accessed": "2026-10-21"
    },
    {
      "id": "luks-dump-v270",
      "title": "cryptsetup v2.7.0: volume-key recovery and exposure",
      "url": "https://gitlab.com/cryptsetup/cryptsetup/-/raw/v2.7.0/man/cryptsetup-luksDump.8.adoc",
      "accessed": "2026-10-21"
    },
    {
      "id": "hesela-luks-observations",
      "title": "Hesela: LUKS header lifetime and identity observations",
      "url": "https://hesela.com/analyses/checksums-identity-and-lost-writes/#luks-header-lifetime",
      "accessed": "2026-10-21"
    },
    {
      "id": "hesela-luks-slots",
      "title": "Hesela: duplicate LUKS credentials with explicit-slot controls",
      "url": "https://hesela.com/analyses/checksums-identity-and-lost-writes/#luks-duplicate-slots",
      "accessed": "2026-10-21"
    }
  ],
  "updated": "2026-10-21"
}