LUKS: Set a New Password Without Knowing the Old One

Scenario

You have:

encrypted.img
luks.key

The old password is unknown. luks.key contains the LUKS master key.

Lab preparation

Create a small encrypted image:

truncate -s 100M encrypted.img
cryptsetup luksFormat encrypted.img

Use a temporary password:

OldPass123

Save the master key:

cryptsetup luksDump \
  --dump-master-key \
  --master-key-file luks.key \
  encrypted.img

Enter:

OldPass123

Now simulate the situation:

encrypted.img   # encrypted file
luks.key        # master key
old password    # unknown

Set a new password

cryptsetup luksAddKey \
  --master-key-file luks.key \
  encrypted.img

Set a new password:

NewPass123

Test

cryptsetup open encrypted.img test

Enter:

NewPass123

Check:

lsblk

Close:

cryptsetup close test

Useful check

cryptsetup luksDump encrypted.img

You should see an additional active keyslot.

Remember

create LUKS image
      ↓
save master key
      ↓
forget old password
      ↓
luksAddKey --master-key-file
      ↓
set new password
      ↓
test with cryptsetup open

Key idea: the old password is not recovered. The master key is used to create a new valid LUKS password.