1 = cryptsetup-reencrypt(8)
3 :manmanual: Maintenance Commands
4 :mansource: cryptsetup {release-version}
5 :man-linkstyle: pass:[blue R < >]
11 cryptsetup-reencrypt - reencrypt LUKS encrypted volumes in-place
15 *cryptsetup _reencrypt_ [<options>] <device> or --active-name <name> [<new_name>]*
19 Run LUKS device reencryption.
21 There are 3 basic modes of operation:
23 * device reencryption (_reencrypt_)
24 * device encryption (_reencrypt_ --encrypt/--new/-N)
25 * device decryption (_reencrypt_ --decrypt)
27 <device> or --active-name <name> (LUKS2 only) is mandatory parameter.
29 Cryptsetup _reencrypt_ action can be used to change reencryption parameters
30 which otherwise require full on-disk data change (re-encryption). The
31 _reencrypt_ action reencrypts data on LUKS device in-place.
33 You can regenerate *volume key* (the real key used in on-disk encryption
34 unclocked by passphrase), *cipher*, *cipher mode* or *encryption sector size*
37 Reencryption process may be safely interrupted by a user via SIGINT
38 signal (ctrl+c). Same applies to SIGTERM signal (i.e. issued by systemd
39 during system shutdown).
41 For in-place encryption mode, the _reencrypt_ action additionally takes all
42 options available for _luksFormat_ action for respective LUKS version (see
43 cryptsetup-luksFormat man page for more details). See *cryptsetup-luksFormat*(8).
45 *NOTE* that for encrypt and decrypt mode, the whole device must be
46 treated as unencrypted -- there are no quarantees of confidentiality as
47 part of the device contains plaintext.
49 *ALWAYS BE SURE YOU HAVE RELIABLE BACKUP BEFORE USING THIS ACTION ON LUKS DEVICE.*
51 *<options>* can be [--batch-mode,
60 --force-offline-reencrypt,
75 --pbkdf-force-iterations,
96 With <device> parameter cryptsetup looks up active <device> dm mapping.
97 If no active mapping is detected, it starts offline LUKS2 reencryption
98 otherwise online reencryption takes place.
100 To resume already initialized or interrupted reencryption, just run the
101 cryptsetup _reencrypt_ command again to continue the reencryption
102 operation. Reencryption may be resumed with different --resilience or
103 --hotzone-size unless implicit datashift resilience mode is used: either
104 encrypt mode with --reduce-device-size option or decrypt mode with
105 original LUKS2 header exported in --header file.
107 If the reencryption process was interrupted abruptly (reencryption
108 process crash, system crash, poweroff) it may require recovery. The
109 recovery is currently run automatically on next activation (action
110 _open_) when needed or explicitly by user (action _repair_).
112 Optional parameter <new_name> takes effect only with encrypt option
113 and it activates device <new_name> immediately after encryption
114 initialization gets finished. That's useful when device needs to be
115 ready as soon as possible and mounted (used) before full data area
116 encryption is completed.
118 == LUKS1 REENCRYPTION
120 Current working directory must be writable and temporary files created during
121 reencryption must be present. During reencryption process the LUKS1 device is
122 marked unavailable and must be offline (no dm-crypt mapping or mounted
125 *WARNING*: The LUKS1 reencryption code is not resistant to hardware
126 or kernel failures during reencryption (you can lose your data in this case).
128 include::man/common_options.adoc[]
132 *NOTE*: You may drop *--type luks2* option as long as LUKS2 format is
135 === LUKS2 ENCRYPTION EXAMPLES
137 Encrypt LUKS2 device (in-place). Make sure last 32 MiB on _/dev/plaintext_
138 is unused (e.g.: does not contain filesystem data):
140 *cryptsetup reencrypt --encrypt --type luks2 --reduce-device-size 32m /dev/plaintext_device*
142 Encrypt LUKS2 device (in-place) with detached header put in a file:
144 *cryptsetup reencrypt --encrypt --type luks2 --header my_luks2_header /dev/plaintext_device*
146 Initialize LUKS2 in-place encryption operation only and activate the device (not yet encrypted):
148 *cryptsetup reencrypt --encrypt --type luks2 --init-only --reduce-device-size 32m /dev/plaintext_device my_future_luks_device*
150 Resume online encryption on device initialized in example above:
152 *cryptsetup reencrypt --resume-only /dev/plaintext_device* or
153 *cryptsetup reencrypt --active-name my_future_luks_device*
155 === LUKS2 REENCRYPTION EXAMPLES
157 Reencrypt LUKS2 device (refresh volume key only):
159 *cryptsetup reencrypt /dev/encrypted_device*
161 === LUKS2 DECRYPTION EXAMPLES
163 Decrypt LUKS2 device with header put in head of data device (header file does not exist):
165 *cryptsetup reencrypt --decrypt --header /export/header/to/file /dev/encrypted_device*
167 Decrypt LUKS2 device with detached header (header file exists):
169 *cryptsetup reencrypt --decrypt --header detached-luks2-header /dev/encrypted_device*
171 Resume interrupted LUKS2 decryption:
173 *cryptsetup reencrypt --resume-only --header luks2-hdr-file /dev/encrypted_device*
175 include::man/common_footer.adoc[]