Detemine which luks slot a passphrase is in

As you've discovered, you can use cryptsetup luksDump to see which key slots have keys.

You can check the passphrase for a particular slot with

cryptsetup luksOpen --test-passphrase --key-slot 0 /dev/sda2 && echo correct

This succeeds if you enter the correct passphrase for key slot 0 and fails otherwise (including if the passphrase is correct for some other key slot).

If you've forgotten one of the passphrases then you can only find which slot it's in by elimination, and if you've forgotten two of the passphrases then there's no way to tell which is which (otherwise the passphrase hash would be broken).

To remove the passphrase you've forgotten, you can safely run cryptsetup luksKillSlot /dev/sda2 0 and enter the passphrase you remember. To wipe a key slot, cryptsetup requires the passphrase for a different key slot, at least when it isn't running in batch mode (i.e. no --batch-mode, --key-file=- or equivalent option).


A simpler way (now?) is to use the command with the --verbose option but without specifying the --key-slot one:

# cryptsetup --verbose open --test-passphrase /dev/sda2
Enter passphrase for /dev/sda2: 
Key slot 4 unlocked.

It will automatically check for you the right slot, without having you looping for finding the good one :)

Tags:

Luks