Sample Header Ad - 728x90

Does crypttab's "key-slot" option mean LUKS will try that keyslot "only", or "first"?

3 votes
2 answers
662 views
I am following the Debian dev's guide to full disk encryption . I am currently on Section 4, step 3- editing /etc/crypttab. In the guide, in section 3 they set up keyslot 0 for something else and now in section 4 are setting up keyslot 1. However, during my setup, section 3 defaulted to keyslot 1, and therefore for section 4 I will need to use keyslot 0, by adding this to my /etc/crypttab: root_crypt UUID=... /etc/keys/root.key luks,discard,key-slot=0 (the guide has key-slot=1 here instead) I think. I worry that I may be wrong, put key-slot=0 when I should have put key-slot=1, so LUKS looks at the wrong slot for decryption, fails to decrypt due to wrong password, and cannot continue. And since everything's encrypted, I can't fix it with a live OS. So my question is: Does the key-slot= option makes LUKS **only** try that keyslot, or try that keyslot **first** and if it fails try the other ones? Assuming I am wrong and put key-slot=0 when I should have put key-slot=1, will LUKS try slot 0, fail, then try slot 1, and succeed? I've read through /etc/crypttab's manpage and found nothing but a reference to cryptsetup -S, but cannot find the manpage that describes this option. I can only find one page on cryptsetup, which doesn't include the -S option. Thank you very much!
Asked by SuperDialga (95 rep)
Jun 5, 2024, 03:02 PM
Last activity: Jun 5, 2024, 03:27 PM