hesela.devLUKS keyslot
A LUKS keyslot is a credential-protected key-management slot used to recover key material for encrypted storage.
Changing a passphrase updates its keyslot rather than necessarily changing the key that encrypts stored data. LUKS2 can also contain unbound keyslots, so a slot must not automatically be interpreted as an active data-segment key. [1] [2]
Hesela's cryptsetup 2.7.0 LUKS1/LUKS2 experiment recovered an unchanged volume key after changing the live passphrase. An earlier header backup still accepted the old credential. These are controlled file observations, not a test of active mappings, reencryption or physical sanitization. [3]
A slot is not a unique credential identity. The same passphrase can protect more than one slot. In Hesela's separate 144-check study, changing slot 0 left the old passphrase usable through slot 1; removing slot 1 stopped that live route. The recovered volume key stayed unchanged. [4]
Relations
- related
- LUKS, LUKS header backup, dm-crypt, Cryptographic erase