[SOLVED] Changing "iterations" on encrypted hdd with data (already) on it

duupunisher2x · 08-22-2020, 08:14 PM

I encrypted my hdd (not ssd) using 'cryptsetup luksOpen..'.

Code:

"sudo cryptsetup luksFormat /dev/sdx --iter-time #"

I want to change the number of seconds (#) before someone can attempt the passphrase for the 2nd time, supposing I type it incorrectly the first time.

I want to do this on a hdd that has data that is not going to be removed, and already encrypted w/ Luks.

Q1: Can it be done under these conditions?
Q2: If yes, what command(s) would work?

Thx.

berndbausch · 08-23-2020, 12:22 AM

I'd try using luksAddKey --iter-time then luksRemoveKey the original key. Perhaps luksChangeKey --iter-time works as well. Before doing it on a disk that contains valuable data, I would try this out on a test device.

duupunisher2x · 08-23-2020, 11:56 PM

Thanks BDB.

I will try them when I have a practice hdd available to try them on.

I'll close the post for now as I don't know how soon I'll be able to try it.

berndbausch · 08-24-2020, 01:50 AM

You don't need a practice HDD. You need a little free space in your filesystem, then create a loop device. Example for a device of size 1G:

Code:

dd if=/dev/zero of=myloopdevice bs=1M count=1024
losetup -f myloopdevice

If all goes well, the losetup command will tell you the name of a loop device like /dev/loop0. You can then encrypt /dev/loop0 and put a filesystem on it.