Arch Linux

kadgabl

Member

Registered: 2025-04-05

Posts: 2

Luks vulnerability? (or am I just dumb af?)

So I encrypted a drive using LUkS and cryptsetup, but later forgot what the password was.
So, I did `cryptsetup luksFormat /dev/sdX1` and it prompted me to enter a new password.
I expected the existing data to disappear, but no, it was still there. I could read all the files, nothing was 'encrypted' at all.

In case you're wondering, I did `cryptsetup luksClose` and plugged the drive out before all this happened, so it couldn't have been any cached password right?

Basically, I just did luksFormat on an encrypted drive, changed the password of it, and accessed the previously encrypted files. This is batshit crazy, even chatgpt couldn't answer my question which made me post about this here.
Thank y'all for taking the time.

frostschutz

Member

Registered: 2013-11-15

Posts: 1,647

Re: Luks vulnerability? (or am I just dumb af?)

cryptsetup luksFormat overwrites any old header and creates a completely new one with a completely random key. And key is at the very least 128bit AES (and another 128bit for XTS). As such the chance for same old encrypted data to be accessible with the new header/key is quite impossible  (1 : 340282366920938463463374607431768211456 or worse).

Also even if passwords are cached anywhere, those would be useless without the old header. (I don't think anything caches volume keys yet, as that would circumvent luks altogether.)

What can happen is that there was still an active /dev/mapper/cryptname mapping still using the old key. Or you're mounting something unrelated / unencrypted from another partition or drive.

Check df -h what is mounted, blkid what exists, and lsblk how it's layered.

kadgabl

Member

Registered: 2025-04-05

Posts: 2

Re: Luks vulnerability? (or am I just dumb af?)

Yeah, I figured it out. At first, I thought I had mounted it, but it wasn't really mounted to the dir, but I still moved files to the dir thinking it was the drive. Then I did the format thing and mounted it to the same directory, which made it look like those files were still present. I was just being dumb
Thanks for the reply!