Arch Linux

spiri

Guest

Lost password of my LUKS-encrypted device

Hello,

I lost my password of my LUKS-encrypted device. I had one password in the head but I was wrong and didn't write it down.

This is the information about the LUKS-encrypted device:

$ sudo cryptsetup luksDump /dev/sdb6
LUKS header information for /dev/sdb6

Version:       	1
Cipher name:   	aes
Cipher mode:   	xts-plain64
Hash spec:     	sha256
Payload offset:	4096
MK bits:       	256
MK digest:     	6b c9 da 71 75 27 63 41 c1 c3 e3 29 2e d6 d9 3f 20 a2 b4 06 
MK salt:       	8b 45 2d 19 9f a0 41 4f 8e 10 bb 0e d8 20 91 e8 
               	89 28 4f ce 2b 8a 3e 17 2e 48 4d d6 45 e3 c1 f6 
MK iterations: 	266406
UUID:          	37be0c89-9eb9-4081-ab70-fd0ad3b3151d

Key Slot 0: ENABLED
	Iterations:         	4245246
	Salt:               	4d f4 0c df 5e 88 21 c7 ab 55 12 91 e6 e3 db be 
	                      	c2 de ec 67 7d ae 12 c5 51 31 09 ab ff 62 1a 2c 
	Key material offset:	8
	AF stripes:            	4000
Key Slot 1: DISABLED
Key Slot 2: DISABLED
Key Slot 3: DISABLED
Key Slot 4: DISABLED
Key Slot 5: DISABLED
Key Slot 6: DISABLED
Key Slot 7: DISABLED

I could be wrong but the password is randomly-generated and must be 20 characters long using any ASCII characters.

Please don't tell me all my data is lost...

Underlying filesystem is formatted as ext4.

Is there any other way to access my data?

Is there any way to recover my data using a Brute Force attack or something like this?

Is there any way to recover my data using a paid service?

Do you need some command output for further support?

I would be glad if you could help me.

loqs

Member

Registered: 2014-03-06

Posts: 19,048

Re: Lost password of my LUKS-encrypted device

The password can be any length up to 512 characters or 8192kB for a keyfile (the compiled in defaults),  there is no minimum length.  The password if typed in can contain any character except newline which marks end of password.
A keyfile can contain any character.

Any way to access data in a LUKS encrypted container without a key would be a defect in cryptsetup / LUKS / dm_crypt.

twelveeighty

Member

Registered: 2011-09-04

Posts: 1,456

Re: Lost password of my LUKS-encrypted device

Also be very careful with these types of posts. I'm not alleging anything, but this post could be seen as soliciting criminal behavior if you're using the phrases "Brute Force" and "paid service" to hack a LUKS device. Remember that a bad person that stole a hard drive can just pretend they forgot a password as well.

frostschutz

Member

Registered: 2013-11-15

Posts: 1,652

Re: Lost password of my LUKS-encrypted device

LUKS incorporates anti-bruteforce measures, so each attempt costs you ~1 second of CPU time

unless you can narrow down the search space significantly, there's pretty much no way to bruteforce a 20 character random ASCII password

a common issue is using the wrong keyboard layout, so if you're not using US layout by default, try both your native layout and the default US layout

spiri

Guest

Re: Lost password of my LUKS-encrypted device

Ok, thanks for the replies so far, I guess I can just erase all the data and use the space for new purposes...

I was just asking if there could be a paid Chaos Recovery Center Service which could open the partition...

frostschutz

Member

Registered: 2013-11-15

Posts: 1,652

Re: Lost password of my LUKS-encrypted device

What you can recover is old unencrypted data (if you did not wipe the disk before encrypting it).

For data recovery, if you can not provide even a hint about the password (whatever you remember then try passwords similar to it), there's no chance.

If the password exists in your brain somewhere, higher chance paying a psychologist or hypnotist or whatever can help you remember it.

If you didn't create it yesterday, if the password was in long term memory, it might just come to you. Try again tomorrow.

If you did create it yesterday... short term memory might be gone. But in that case the data on that drive had to come from somewhere. Maybe you can recover it from wherever you copied it from.

Either way, there's no method to circumvent encryption, that's what it's there for. It can't be cracked by conventional means.

good luck

PS: another possibility is also that the LUKS header got damaged. you might be using the correct password but it's just not accepted anymore. unless it's a single bit error, this can not be recovered from, either

Last edited by frostschutz (2020-08-17 17:23:37)

fistrosan

Member

Registered: 2020-04-01

Posts: 171

Re: Lost password of my LUKS-encrypted device

PS: another possibility is also that the LUKS header got damaged. you might be using the correct password but it's just not accepted anymore. unless it's a single bit error, this can not be recovered from, either

This happened to me the very first time I did and arch+LUKS install. I forgot to umount all devices before rebooting and in doing so the LUKS header was damaged. I could not mount it even with the correct password. I had to redo the install. Luckily I did not lose any data.

Related to the original problem: in LUKS1 I believe there are some chances to do a brute force attack, but with LUKS2 the number of characters is too large to allow for this.

loqs

Member

Registered: 2014-03-06

Posts: 19,048

Re: Lost password of my LUKS-encrypted device

fistrosan a-zA-Z0-9=60 characters,  20 long gives 62^20=7.0442×10³⁵ multiplied by 512 possibilities supplied by the salt.

fistrosan

Member

Registered: 2020-04-01

Posts: 171

Re: Lost password of my LUKS-encrypted device

fistrosan a-zA-Z0-9=60 characters,  20 long gives 62^20=7.0442×10³⁵ multiplied by 512 possibilities supplied by the salt.

Yes of course, if it is purely random it is literally not possible (although I still remember LUKS1 uses 256 bits instead of 512 as in LUKS2 which makes LUKS1 "less safe"), but if you (maybe) remember an entire sequence of characters or a word within the passphrase, those can dramatically reduce the number of computations needed by brute force attacks. At any rate, even in that scenario one would need access to a supercomputer to be able to perform them and it is simply not worth the effort.

spiri

Guest

Re: Lost password of my LUKS-encrypted device

I guess it was a randomly generated password which I saved in a file and opened the partition with crypttab.

I think I will keep the partition as long as I don't need more space.

loqs

Member

Registered: 2014-03-06

Posts: 19,048

Re: Lost password of my LUKS-encrypted device

The keyfile or crypttab containing the key may be recoverable.  If you want to attempt recovery stop using that filesystem.  Writing more data to it increases the chances of overwriting the blocks you wish to recover.
Was that filesystem encrypted?  Was the filesystem trimmed?  Do you know how the file came to be lost?

frostschutz

Member

Registered: 2013-11-15

Posts: 1,652

Re: Lost password of my LUKS-encrypted device

saved in a file, where? if it was inside the luks container, tough luck. if it was on /dev/shm (in RAM, in a livecd environment, ...), likewise.

if it was saved unencrypted on disk, you might be able to locate it.

spiri

Guest

Re: Lost password of my LUKS-encrypted device

I had an encrypted filesystem with my backup partition /dev/sdb6 which automatically does backups on this partition and crypttab loads the file from /etc/backup.passwd which was also encrypted.

Then I wiped the system including backup.passwd and there is just an encrypted backup partition left on the second hard disk.

I guess there is no recovery option anymore.