cryptsetup upgrade.inline.ar

  1. To verify whether your encrypted volume uses PBKDF2 or Argon2id, execute the following command.

    Replace [partition] with the partition name found in step 1.6.

    cryptsetup luksDump /dev/[partition]

    In the output:

    • Version indicates the version of LUKS, either 1 or 2.

    • PBKDF indicates the key derivation function, either pbkdf2 or argon2id.

    If your encrypted volume already uses LUKS2 and Argon2id, you can stop here.

  2. Execute the following command to do a backup of your LUKS1 header.

    Replace [partition] with the partition name found in step 1.6.

    cryptsetup luksHeaderBackup /dev/[partition] --header-backup-file /home/amnesia/luks1header

    If something goes wrong, you will be able to restore your LUKS1 header from this backup with:

    cryptsetup luksHeaderRestore /dev/[partition] --header-backup-file /home/amnesia/luks1header

  3. To update your LUKS header to LUKS2, execute the following command.

    Replace [partition] with the device name found in step 1.6.

    cryptsetup convert /dev/[partition] --type luks2

  4. To verify that Argon2id is the new key derivation function, execute the following command again.

    Replace [partition] with the partition name found in step 1.6.

    cryptsetup luksDump /dev/[partition]

    In the output, verify that:

    • The Version is 2 and not 1.

    • The PBKDF is argon2id and not pbkdf2.

  5. Try to unlock your encrypted volume.