Encrypt disk volume with LUKS, enable access without passphrase

2

How can I set “no passphrase, and don't prompt for one” on a LUKS volume, leaving it encrypted as is?

Enabling LUKS encryption is a one-way, time-consuming operation. I need to divide the set-up of that encrypted volume into two steps:

  • When setting up the machine: Encrypt the partition with LUKS, wait for it to complete, and have that be the last time the encryption or formatting is needed.

    This takes a long time, and it should be done when the other time-consuming activities (testing the hardware, installing the operating system, downloading software packages, etc.) are done, with no need for the eventual user to be involved.

  • When configuring the OS later: Choose a passphrase for authenticating access to the partition.

    This needs to be done by the eventual user, and needs to be fast: choose a passphrase, and that is instantly the passphrase that protects the already-encrypted volume.

These two steps are done at different times in different locations by different people.

We can assume the person doing technical set-up has technical knowledge and professional care. We cannot assume this for the person setting a passphrase for the volume; it must be quick, simple, and uncomplicated: a single command that executes very quickly.

So I need a way to be able to choose no passphrase for the volume, and leave the option to simply defer until later the choice of passphrase — without reformatting the volume.

bignose

Posted 2015-09-07T00:31:12.037

Reputation: 1 981

2Note that the master key (i.e., the encryption key of the underlying block cipher) of a LUKS volume cannot be changed without re-encrypting the entire volume; changing a passphrase merely re-encrypts the master key under a new passphrase-derived key. In the second step, under any scheme that does not perform a full re-encryption of the data, the user cannot feasibly verify whether a copy of the master key has been stored by the creator, or by anyone who once obtained access (whether authorized or not) to the volume. – Vincent Yu – 2015-09-07T04:12:05.727

@VincentYu Agreed, very unwise security design just tring to save time. What is the time that encryption is taking? SSD drive or SED for speed? – StackAbstraction – 2015-09-07T23:58:55.733

No answers