A wireframe globe breaking out of chains

Free the internet

Support tools that break the chains of censorship and surveillance. Donate to the Tor Project today.

Through December 31, your gift will be matched, up to $250,000!

Donate now

cryptsetup upgrade.inline

  1. To verify whether your encrypted volume uses PBKDF2 or Argon2id, execute the following command. Replace [partition] with the partition name found in step 1.6.

    cryptsetup luksDump /dev/[partition]

    In the output:

    • Version indicates the version of LUKS, either 1 or 2.

    • PBKDF indicates the key derivation function, either pbkdf2 or argon2id.

    If your encrypted volume already uses LUKS2 and Argon2id, you can stop here.

  2. Execute the following command to do a backup of your LUKS1 header. Replace [partition] with the partition name found in step 1.6.

    cryptsetup luksHeaderBackup /dev/[partition] --header-backup-file /home/amnesia/luks1header

    If something goes wrong, you will be able to restore your LUKS1 header from this backup with:

    cryptsetup luksHeaderRestore /dev/[partition] --header-backup-file /home/amnesia/luks1header

  3. To update your LUKS header to LUKS2, execute the following command. Replace [partition] with the device name found in step 1.6.

    cryptsetup convert /dev/[partition] --type luks2

  4. To verify that Argon2id is the new key derivation function, execute the following command again. Replace [partition] with the partition name found in step 1.6.

    cryptsetup luksDump /dev/[partition]

    In the output, verify that:

    • The Version is 2 and not 1.

    • The PBKDF is argon2id and not pbkdf2.

  5. Try to unlock your encrypted volume.