LUKS Encryption keys location after setup

Bazzite
1

Where are the keys stored for LUKS partitions generated in Blivet after setup?

I have 3 LUKS-encrypted partitions, but I only need to enter decryption password once. I am curious where Anaconda & Blivet have saved the other two passwords. I may need to know that in case I forget those, can’t access my password storage & need to examine those partitions from another OS. I also want to save my second drive LUKS password somewhere system-wide so it will be unlocked on boot for all users.

Where I have looked already:

  • /etc/crypttab doesn’t mention any key files
  • /etc/lusk-keys/ doesn’t exist
  • /etc/cryptsetup-keys.d/ doesn’t exits
  • I can’t see anything LUKS-related in tpm

There are systemd-cryptsetup related logs in journalctl -b for multiple LUKS devices.

Where does systemd-cryptsetup store LUKS keys?

2

are you sure they’re stored on disk? How does Fedora handle this? I’m curious as well.

I believe some versions of grub (older, perhaps) would simply try the same first key you typed against any subsequent LUKS devices.

1 Like
3

This is what I suspect now as well. Participants of other forums told me that.