Différences

Ci-dessous, les différences entre deux révisions de la page.

--- tech:notes_luks_cryptsetup [2025/03/24 15:06] – créée - modification externe 127.0.0.1
+++ tech:notes_luks_cryptsetup [2025/04/18 09:57] (Version actuelle) – Jean-Baptiste
@@ Ligne 1: / Ligne 1: @@
-{{tag>Brouillon}}
+<!DOCTYPE markdown>
+{{tag>Brouillon Crypt FS}}
-= Notes luks cryptsetup
+# Notes luks cryptsetup
 Voir aussi :
 * https://gitlab.com/cryptsetup/cryptsetup/wikis/FrequentlyAskedQuestions#6-backup-and-data-recovery
 * homectl
+* Clevis / Tang Server
 Add a new passphrase
-<code bash>
+~~~bash
 cryptsetup luksAddKey /dev/nvme0n1p3
-</code>
+~~~
-<code bash>
+~~~bash
 cryptsetup luksDump /dev/sda2
-</code>
+~~~
-== Upgrade your LUKS key derivation function
+## Upgrade your LUKS key derivation function
 Source :
-* [[https://mjg59.dreamwidth.org/66429.html|upgrade your LUKS key derivation function]]
+* [Upgrade your LUKS key derivation function](https://mjg59.dreamwidth.org/66429.html)
-  ** https://nantes.indymedia.org/posts/87395/une-lettre-divan-enferme-a-la-prison-de-villepinte-perquisitions-et-disques-durs-dechiffres/
+    * https://nantes.indymedia.org/posts/87395/une-lettre-divan-enferme-a-la-prison-de-villepinte-perquisitions-et-disques-durs-dechiffres/
-<code bash>
+~~~bash
 lsblk
 sudo cryptsetup luksHeaderBackup /dev/whatever --header-backup-file /tmp/luksheader
-</code>
+~~~
 Copy that to a USB stick or something. If something goes wrong here you'll be able to boot a live image and run
-<code bash>
+~~~bash
 sudo cryptsetup luksHeaderRestore /dev/whatever --header-backup-file luksheader
-</code>
+~~~
 to restore it.
@@ Ligne 38: / Ligne 40: @@
 Next, run
-<code bash>
+~~~bash
 sudo cryptsetup luksDump /dev/whatever
-</code>
+~~~
 and look for the Version: line. If it's version 1, you need to update the header to LUKS2. Run
-<code bash>
+~~~bash
 sudo cryptsetup convert /dev/whatever --type luks2
-</code>
+~~~
 and follow the prompts. Make sure your system still boots, and if not go back and restore the backup of your header. Assuming everything is ok at this point, run
-<code bash>
+~~~bash
 sudo cryptsetup luksDump /dev/whatever
-</code>
+~~~
 again and look for the PBKDF: line in each keyslot (pay attention only to the keyslots, ignore any references to pbkdf2 that come after the Digests: line). If the PBKDF is either **pbkdf2** or **argon2i** you should convert to **argon2id**. Run the following:
-<code bash>
+~~~bash
 sudo cryptsetup luksConvertKey /dev/whatever --pbkdf argon2id
-</code>
+~~~
 and follow the prompts. If you have multiple passwords associated with your drive you'll have multiple keyslots, and you'll need to repeat this for each password.