correct luks passphrase not working

robak

Hi folks,

for my data I use a luks1 encrypted raid5. After I encountered a drive failure (see https://forums.gentoo.org/viewtopic-t-1114614-highlight-luks.html), rebuilded the raid and reinstalled the system my passphrase is not working anymore. I hope it's just me using cryptsetup wrong to open the device. So any help is highly appreciated.
Thou I know the passphrase is correct, I bruteforced all possible passphrases that I COULD have used, just to be sure I didn't missspell something.

Here is some output:

cryptsetup:

pietinger · Posted: Thu Jun 11, 2020 11:08 am Post subject:

Do you have a backup from your luks header ?

robak · Posted: Thu Jun 11, 2020 11:30 am Post subject:

nope :/

btw: I try to open the volume via

pietinger · Posted: Thu Jun 11, 2020 1:05 pm Post subject:

robak · Posted: Thu Jun 11, 2020 3:32 pm Post subject:

Any explanation how/why a recovery and or reinstallation of linux could damage/change a luks passphrase.
Would cryptsetup realize a damaged key?
_________________
run this in your gentoo-bash:
"grep -R -i -A2 -B2 'on fire' /usr/src/linux/*"

pietinger · Posted: Thu Jun 11, 2020 4:02 pm Post subject:

fturco · Veteran Joined: 08 Dec 2010 Posts: 1181

The following link may be helpful: https://gitlab.com/cryptsetup/cryptsetup/-/wikis/FrequentlyAskedQuestions

Hu · Administrator Joined: 06 Mar 2007 Posts: 23093

Since your location specifies Germany, I am going to guess that you might use a keyboard layout other than US English. There have been problems over the years where someone with a non-US keyboard would enter their passphrase with their native layout, then the early boot logic would request the password while the keyboard was still set for US English - and the passphrase was not spelled the same between the two layouts. For recovery purposes, you may want to write the password in your favorite text editor, where you can see what you write, then paste that into the luksOpen prompt, so that cryptsetup receives exactly the text you visually confirmed as correct.

Budoka · l33t Joined: 03 Jun 2012 Posts: 777 Location: Tokyo, Japan

Threads like this scare the hell out of me and this one may explain the continuing issue I've had with a mirrored drive not recognizing a correct luks password BUT...

What is it we should be "backing up" to prevent this kind of thing from happening???

Thanks

pietinger · Posted: Fri Jun 12, 2020 5:35 am Post subject:

robak · Posted: Fri Jun 12, 2020 7:10 am Post subject:

Thank you for all the hints!

I am aware of the keyboard layout and checked that, too.

Well yes, backing up the header and store it in your own local nextcloud/owncloud instance would be a solution. In the case that the drives are dying and the encryption gets broken you would still have the header on your clients.
_________________
run this in your gentoo-bash:
"grep -R -i -A2 -B2 'on fire' /usr/src/linux/*"