Single User (single or multiple keyslots with similar or different passphrase)

Single User (single or multiple keyslots with similar or different passphrase)

[Lamy Geier]

Hello!

I am a single user and owner of the data in my laptop. I was wondering 
if it is any better to have single or multiple keyslots with same or 
different passphrases. I am using LUKS2 on a partition for root, home 
and swap volumes (LVM). And LUKS1 for a boot partition. Please suggest 
which of the following is better choice and why:

1. Should I have single passphrase and single keyslot for LUKS1 and LUKS2?
2. Multiple Keyslots for LUKS1 and LUKS2 with same passphrase.
3. Multiple Keyslots for LUKS1 and LUKS2 with different passphrase.


- My reasoning was that may be having redundant information, it helps in 
times of crisis for recovery.

- Note: The data will be owned and used only by me.

-- 
Thanks and Regards

Lamy

Frequency of backup of headers for LUKS1 and LUKS2

[Lamy Geier]

Given that I won't add or remove any key from header key slot, or I 
won't re-encrypt (i.e. change the master key), how often do I need to 
backup the LUKS1 and LUKS2 header? Is doing the backup once enough and 
making sure that the backup is not corrupted?

Are there any other situation where one needs to backup the headers of 
LUKS1 and LUKS2 more often?

I was wondering if the contents of header changes in any other way, that 
requires backup, if it affects restore possibility.

Thanks and Regards

Lamy

Re: Frequency of backup of headers for LUKS1 and LUKS2

[Arno Wagner]

Header backup is only needed if you change the header.
Data-area backup is another question.

Arno


On Mon, Nov 21, 2022 at 12:06:57 CET, Lamy Geier wrote:
> Given that I won't add or remove any key from header key slot, or I won't
> re-encrypt (i.e. change the master key), how often do I need to backup the
> LUKS1 and LUKS2 header? Is doing the backup once enough and making sure that
> the backup is not corrupted?
> 
> Are there any other situation where one needs to backup the headers of LUKS1
> and LUKS2 more often?
> 
> I was wondering if the contents of header changes in any other way, that
> requires backup, if it affects restore possibility.
> 
> Thanks and Regards
> 
> Lamy

-- 
Arno Wagner,     Dr. sc. techn., Dipl. Inform.,    Email: arno@wagner.name
GnuPG: ID: CB5D9718  FP: 12D6 C03B 1B30 33BB 13CF  B774 E35C 5FA1 CB5D 9718
----
A good decision is based on knowledge and not on numbers. -- Plato

If it's in the news, don't worry about it.  The very definition of 
"news" is "something that hardly ever happens." -- Bruce Schneier

Re: Single User (single or multiple keyslots with similar or different passphrase)

[Arno Wagner]

One Keyslot should be enough, but you should hve a header backup.
The only redundancy multiple passphrases give you is basically
multiple passphrases.

Regards,
Arno


On Mon, Nov 21, 2022 at 09:42:37 CET, Lamy Geier wrote:
> Hello!
> 
> I am a single user and owner of the data in my laptop. I was wondering if it
> is any better to have single or multiple keyslots with same or different
> passphrases. I am using LUKS2 on a partition for root, home and swap volumes
> (LVM). And LUKS1 for a boot partition. Please suggest which of the following
> is better choice and why:
> 
> 1. Should I have single passphrase and single keyslot for LUKS1 and LUKS2?
> 2. Multiple Keyslots for LUKS1 and LUKS2 with same passphrase.
> 3. Multiple Keyslots for LUKS1 and LUKS2 with different passphrase.
> 
> 
> - My reasoning was that may be having redundant information, it helps in
> times of crisis for recovery.
> 
> - Note: The data will be owned and used only by me.
> 
> -- 
> Thanks and Regards
> 
> Lamy

-- 
Arno Wagner,     Dr. sc. techn., Dipl. Inform.,    Email: arno@wagner.name
GnuPG: ID: CB5D9718  FP: 12D6 C03B 1B30 33BB 13CF  B774 E35C 5FA1 CB5D 9718
----
A good decision is based on knowledge and not on numbers. -- Plato

If it's in the news, don't worry about it.  The very definition of 
"news" is "something that hardly ever happens." -- Bruce Schneier