0

I accidentally overwrote a whole LUKS1 header without any backup. Since I still have the password with which the header was created - is there any way that this information helps me to reduce the range of potential master keys?

I realize that the mapping from password to key still involves some randomization, so this range might still be pretty big. But assuming I am willing to put in a few years of brute-forcing effort - is there any hope?

Or is the master key completely detached from my password and the only solution to get back my data would be to brute-force a 256 bit key? (which I know is virtually impossible)

Philipp Murry
  • 183
  • 1
  • 5

1 Answers1

1

Or is the master key completely detached from my password

Yes, it is. Otherwise there couldn't be more than one password, and changing that password would require re-encrypting all the data.

That's how any halfway reasonable password-based encryption works: there's a randomly generated data encryption key (DEK) which is stored encrypted with a password-derived key. If the password changes, only the encrypted copy of the DEK needs to be updated. If there are multiple passwords, each has its own encrypted copy of the DEK.

Brute-forcing the data encryption key is not an option. A 128-bit key would take billions of billions of processor-years to brute-force. A 256-bit key is a whole lot more expensive.

Off-topic: some disk encryption formats store multiple copies of the header in case one gets accidentally overwritten. But LUKS doesn't, as far as I know.

Gilles 'SO- stop being evil'
  • 19,134
  • 4
  • 50
  • 92