4

I know that a LUKS partition has a plain-text header that stores many informations like master key (MK) digest, MK iterations of PBKDF2, information about the 8 key-slots etc. I also know that in the header there is the af-splitted and encrypted master key.

I'm asking if there is a way to recover that. I know I could simply use:

cryptsetup luksDump --dump-master-key /dev/whatever

However, this only give me the decrypted MK.


Only information I have are from header:

key-material-offset: 8 (start sector of key material)

number of stripes: 4000

My goal would be to manually decrypt the master key with the derived key from pbkdf2, do af-merge and then decrypt the whole data bulk with this candidate key.

  • read the relevant position of your hard drive? – SEJPM Jan 7 '16 at 15:53
  • Yes but the mk is stripped and I don't know how. I edited the question with more infos. – refex Jan 7 '16 at 17:53
3

It looks like this is what you want. It creates a copy of the header, without making any assumptions about the header size.

# cryptsetup luksHeaderBackup /dev/sda5 --header-backup-file /tmp/luks-header

But I'm not sure if I 100% understand your question. Are you asking how to extract the LUKS header including the master key, or just the encrypted master key and nothing else?

0

This would dump the entire LUKS header, which includes the encrypted key:

dd if=/dev/whatever bs=2M count=1 of=luks-header.img
  • 3
    Depending on drive layout, LUKS version, and partition scheme, this will not always work. – forest Apr 5 '16 at 3:19
  • My luks header have 2.1MB so this command won't work in my case. I suggest to use @forest method or set a safer value like 32MB – JonLord May 20 at 4:20
0

Assuming that you can mount the LUKS volume, do this when it is mounted:

 $ dmsetup table --showkey myvolume
 0 200704 crypt aes-xts-plain64 0ef81...9aef7 0 8:18 4096

The long string is the master key.

But this is the same as

$ cryptsetup luksDump --dump-master-key /dev/myrawvolume
MK dump: 0e f8 1. .. .. ..
         .. .. .. .9 ae f7

So I am not sure what your're asking...

I wrote a program ages ago which dumps out a LUKS key, it's written in Ruby and might be handy if you're trying to understand how to perform the necessary steps to extract the key.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.