0
$\begingroup$

I accidentally overwrote a whole LUKS1 header without any backup. Since I still have the password with which the header was created - is there any way that this information helps me to reduce the range of potential master keys?

I realize that the mapping from password to key still involves some randomization, so this range might still be pretty big. But assuming I am willing to put in a few years of brute-forcing effort - is there any hope?

Or is the master key completely detached from my password and the only solution to get back my data would be to brute-force a 256 bit key? (which I know is virtually impossible)

$\endgroup$
1

1 Answer 1

1
$\begingroup$

Or is the master key completely detached from my password

Yes, it is. Otherwise there couldn't be more than one password, and changing that password would require re-encrypting all the data.

That's how any halfway reasonable password-based encryption works: there's a randomly generated data encryption key (DEK) which is stored encrypted with a password-derived key. If the password changes, only the encrypted copy of the DEK needs to be updated. If there are multiple passwords, each has its own encrypted copy of the DEK.

Brute-forcing the data encryption key is not an option. A 128-bit key would take billions of billions of processor-years to brute-force. A 256-bit key is a whole lot more expensive.

Off-topic: some disk encryption formats store multiple copies of the header in case one gets accidentally overwritten. But LUKS doesn't, as far as I know.

$\endgroup$
2
  • $\begingroup$ No, it is not possible. LUKS generate keys sampling bits from the kernel random number generator. If you don't have a backup of the header you can forget your data. $\endgroup$
    – ddddavidee
    Commented Jan 20 at 13:53
  • $\begingroup$ @PhilippMurry If you could do that, anybody else could also do that, and encryption would be pointless. $\endgroup$ Commented Jan 20 at 17:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.