Arch Linux

devetdeset

Member

Registered: 2024-06-11

Posts: 7

unable to decrypt luks drive."No key available with this passphrase"

hello,

i have been unable to boot into my system because my password no longer works on cryptsetup boot request.
a few days ago, i rebooted my system after a kernel update. when i tried to enter my password to decrypt the drive, it would no longer work.
i would get the output:

No key available with this passphrase

i thought it might be an issue with the kernel update. so i chrooted into the system from a arch usb. there was a issue when compiling the kernel headers, but i fixed it with some help from the forum. here is the original post.

after the kernel successfully built i rebooted into my system and got the same issue again.

here is journalctl output:

~ > doas journalctl -u systemd-cryptsetup@ainstnvme0n1p3.service | tail -n 10
Jun 06 15:11:32 arch systemd[1]: Stopping Cryptography Setup for ainstnvme0n1p3...
Jun 06 15:11:32 arch systemd[1]: systemd-cryptsetup@ainstnvme0n1p3.service: Deactivated successfully.
Jun 06 15:11:32 arch systemd[1]: Stopped Cryptography Setup for ainstnvme0n1p3.
-- Boot 56cc6ded8ef846a3a8f8a7a1a5d9a12d --
Jun 06 15:12:09 arch systemd[1]: Starting Cryptography Setup for ainstnvme0n1p3...
Jun 06 15:12:09 arch systemd-cryptsetup[1832]: Set cipher aes, mode xts-plain64, key size 512 bits for device /dev/disk/by-uuid/55925125-de1b-43f2-8a11-808bac331632.
Jun 06 15:12:12 arch systemd[1]: Finished Cryptography Setup for ainstnvme0n1p3.
Jun 10 18:55:24 arch systemd[1]: Stopping Cryptography Setup for ainstnvme0n1p3...
Jun 10 18:55:24 arch systemd[1]: systemd-cryptsetup@ainstnvme0n1p3.service: Deactivated successfully.
Jun 10 18:55:24 arch systemd[1]: Stopped Cryptography Setup for ainstnvme0n1p3.

and shortened dmesg file: https://pastebin.com/mry4CpgW

i have used this system for the past few months with no issues. this is the first time this has happened.

thank you.

frostschutz

Member

Registered: 2013-11-15

Posts: 1,647

Re: unable to decrypt luks drive."No key available with this passphrase"

If it's a LUKS 2 header with argon2 keyslot, that is very sensitive to memory issues, so bad ram leads to "No key available with this passphrase." errors. In this case you can run a memtest, load default clock settings / ram timings in bios, or try opening it on another system altogether.

Another common issue is wrong keyboard layout, if you're not using US keyboard by default. The keyboard could also have a stuck key, see if you can enter your passphrase fine in a text editor or not.

These aside, it leaves human error (actually using the wrong passphrase; trying to open the wrong device when not using UUIDs; etc.) or game-over scenarios like corrupted key material.

cryptsetup luksDump should show offset and size of key material for each of your keyslots; you could use hexdump to check if it looks like random data or not. Unfortunately there is no way to tell for sure - key material does not have any checksums, it either works or it doesn't.

There are more exotic cases, like some years back there was an incompatible change with some ciphers or hashes. But unless something was broken recently, this is highly unlikely to be your issue.

devetdeset

Member

Registered: 2024-06-11

Posts: 7

Re: unable to decrypt luks drive."No key available with this passphrase"

sorry, i forgot to mention that i am able to decrypt the drive completely fine on the usb. i also loaded an ubuntu live usb and was also able to decrypt the drive on there using the password. the only issue is when i try to enter the decryption password on boot. i have also never changed ram timings or clock speeds.

Last edited by devetdeset (2024-06-11 21:14:22)

Nikolai5

Member

From: North West, England, UK

Registered: 2024-01-27

Posts: 275

Re: unable to decrypt luks drive."No key available with this passphrase"

What bootloader are you using? If systemd-boot then please show us the contents of your entries conf files.

If it's grub then show us /etc/default/grub

Then show us the output of `sudo blkid`

---

Ryzen 7 9850X3D | AMD 7800XT | KDE Plasma

devetdeset

Member

Registered: 2024-06-11

Posts: 7

Re: unable to decrypt luks drive."No key available with this passphrase"

sure.

[root@archiso /]# cat /etc/default/grub
# GRUB boot loader configuration

GRUB_DEFAULT=0
GRUB_TIMEOUT=5
GRUB_DISTRIBUTOR="Arch"
GRUB_CMDLINE_LINUX_DEFAULT="loglevel=3 quiet"
GRUB_CMDLINE_LINUX="cryptdevice=UUID=ec58ff8d-909c-46f3-a870-ab214dddf41b:cryptlvm rootfstype=ext4"

# Preload both GPT and MBR modules so that they are not missed
GRUB_PRELOAD_MODULES="part_gpt part_msdos"

# Uncomment to enable booting from LUKS encrypted devices
GRUB_ENABLE_CRYPTODISK=y

# Set to 'countdown' or 'hidden' to change timeout behavior,
# press ESC key to display menu.
GRUB_TIMEOUT_STYLE=menu

# Uncomment to use basic console
GRUB_TERMINAL_INPUT=console

# Uncomment to disable graphical terminal
#GRUB_TERMINAL_OUTPUT=console

# The resolution used on graphical terminal
# note that you can use only modes which your graphic card supports via VBE
# you can see them in real GRUB with the command `videoinfo'
GRUB_GFXMODE=auto

# Uncomment to allow the kernel use the same resolution used by grub
GRUB_GFXPAYLOAD_LINUX=keep

# Uncomment if you want GRUB to pass to the Linux kernel the old parameter
# format "root=/dev/xxx" instead of "root=/dev/disk/by-uuid/xxx"
#GRUB_DISABLE_LINUX_UUID=true

# Uncomment to disable generation of recovery mode menu entries
GRUB_DISABLE_RECOVERY=true
GRUB_DISABLE_OS_PROBER=false

# Uncomment and set to the desired menu colors.  Used by normal and wallpaper
# modes only.  Entries specified as foreground/background.
#GRUB_COLOR_NORMAL="light-blue/black"
#GRUB_COLOR_HIGHLIGHT="light-cyan/blue"

# Uncomment one of them for the gfx desired, a image background or a gfxtheme
#GRUB_BACKGROUND="/path/to/wallpaper"
#GRUB_THEME="/path/to/gfxtheme"

# Uncomment to get a beep at GRUB start
#GRUB_INIT_TUNE="480 440 1"

# Uncomment to make GRUB remember the last selection. This requires
# setting 'GRUB_DEFAULT=saved' above.
#GRUB_SAVEDEFAULT=true

# Uncomment to disable submenus in boot menu
#GRUB_DISABLE_SUBMENU=y

# Probing for other operating systems is disabled for security reasons. Read
# documentation on GRUB_DISABLE_OS_PROBER, if still want to enable this
# functionality install os-prober and uncomment to detect and include other
# operating systems.
#GRUB_DISABLE_OS_PROBER=false

[root@archiso /]# blkid
/dev/nvme0n1p3: UUID="55925125-de1b-43f2-8a11-808bac331632" TYPE="crypto_LUKS" PARTLABEL="primary" PARTUUID="79696bea-bf7a-41b1-ae94-394675c52fae"
/dev/nvme0n1p1: UUID="64B4-BEBC" BLOCK_SIZE="512" TYPE="vfat" PARTLABEL="primary" PARTUUID="ed74c10c-be52-4782-8584-7d6503c4e9e0"
/dev/nvme0n1p2: UUID="ec58ff8d-909c-46f3-a870-ab214dddf41b" TYPE="crypto_LUKS" PARTLABEL="primary" PARTUUID="4b1eb5e4-d44d-411d-be88-e6e18e6a3070"
/dev/loop0: BLOCK_SIZE="1048576" TYPE="squashfs"
/dev/nvme1n1p1: UUID="b3fe2e8d-47d3-4d59-b7e6-9f7fed38c925" BLOCK_SIZE="4096" TYPE="ext4" PARTLABEL="primary" PARTUUID="d94dae5a-c571-4092-839c-b554443c260a"
/dev/sda2: SEC_TYPE="msdos" LABEL_FATBOOT="ARCHISO_EFI" LABEL="ARCHISO_EFI" UUID="EB57-F0E2" BLOCK_SIZE="512" TYPE="vfat" PARTUUID="99a0587f-02"
/dev/sda1: BLOCK_SIZE="2048" UUID="2023-12-01-15-40-55-00" LABEL="ARCH_202312" TYPE="iso9660" PARTUUID="99a0587f-01"

Nikolai5

Member

From: North West, England, UK

Registered: 2024-01-27

Posts: 275

Re: unable to decrypt luks drive."No key available with this passphrase"

And you are using lvm?

Have you checked the articles in the grid here: https://wiki.archlinux.org/title/Dm-cry … m#Overview
If your setup is listed as a scenario there, it should include instructions and troubleshooting on each one. It sounds like config around mkninitcpio and the boot loader to me rather than a hardware fault. Either that or a keyboard layout issue on boot.

Last edited by Nikolai5 (2024-06-12 14:12:53)

---

Ryzen 7 9850X3D | AMD 7800XT | KDE Plasma

devetdeset

Member

Registered: 2024-06-11

Posts: 7

Re: unable to decrypt luks drive."No key available with this passphrase"

yes. my system was configured by archinstall when i first created it. it has been working for many months now with no fault. in my setup, home partition and root partition are encrypted with lvm.

Nikolai5

Member

From: North West, England, UK

Registered: 2024-01-27

Posts: 275

Re: unable to decrypt luks drive."No key available with this passphrase"

I know its probably something you've done already, but have you checked to see if the HOOKS in /etc/mkinitcpio.conf contains "encrypt" and "lvm2" before the "filesystems" entry?
Then regenerate initramfs by running `mkinitpcio -P`

You can do that from inside chrooted system from the live iso.

---

Ryzen 7 9850X3D | AMD 7800XT | KDE Plasma

devetdeset

Member

Registered: 2024-06-11

Posts: 7

Re: unable to decrypt luks drive."No key available with this passphrase"

hi. i tried the instructions you gave me, but the same issue still persists.