Rekeying LUKS volume

1. Unmount the mounted volume from the mountpoint.

# umount /mnt/hdd 

Unmounting the mounted volume

2. Detach the attached LUKS volume.

# /usr/lib/systemd/systemd-cryptsetup detach mydisk /dev/sdc1 - pkcs11uri="auto" 

Detach the attached LUKS volume

3. Generate a new RSA key using p11tool2.

# p11tool2 Slot=<no> LoginUser=ask 

PubKeyAttr=CKA_LABEL="NEWPublicKey",CKA_ID=0x46 

PrvKeyAttr=CKA_LABEL="NEWPrivateKey",CKA_ID=0x46 GenerateKeyPair=RSA 

Key generation output

4. Verify that the keys are generated onto the HSM using following command.

# p11tool2 Slot=<no> LoginUser=ask ListObjects

Key list using p11tool2

5. Generate a self-signed certificate with the generated key.

# openssl req -x509 -engine pkcs11 -keyform engine -new -key

"pkcs11:token=UTILUKS;object=NEWPrivateKey" -sha256 -out newcert.pem subj "/CN=localhost"

self-sign certificate generation

6. Convert newcert.pem to newcert.der format.

# openssl x509 -outform der -in newcert.pem -out newcert.der

Certificate type change output

7. Import the certificate onto HSM.

# p11tool2 slot=<no> LoginUser=ask

CertAttr=CKA_LABEL="NEWCERT",CKA_ID=0x46

PubKeyAttr=CKA_LABEL="NEWPublicKey",CKA_ID=0x46

ImportCert=/opt/utimaco/bin/newcert.der

Certificate import using p11tool2

8. Check that the certificate is imported successfully on HSM.

# p11tool2 Slot=<no> LoginUser=ask ListObjects 

Certificate list output

9. List the objects on the slot and note down the URL of the new certificate and new private key.

# p11tool --provider /opt/utimaco/lib/libcs_pkcs11_R3.so --login --listall pkcs11:token=UTILUKS 

Slot objects list

10. Enroll the certificate on LUKS drive using systemd-cryptenroll command.

# systemd-cryptenroll --pkcs11-token-

uri="pkcs11:model=CryptoServer;manufacturer=Utimaco%20IS%20GmbH; serial=CS710843_0014;token=UTILUKS;id=%46;object=NEWCERT;type=cert" /dev/sdc1 

systemd-cryptenroll command output

11. Verify that the pkcs11 url of new certificate is added to the luks partition in the token section.

# cryptsetup luksDump /dev/sdc1 

Encrypted volume information

Encrypted volume information

12. Open the luks volume as newbackup disk.

# cryptsetup luksOpen /dev/sdc1 newbackup 

luksopen command output

13. Export token using below command to header.json file

# cryptsetup token export –-token-id 0 /dev/sdc1 > header.json  

Exporting token id information

14. Open header.json file and replace the pkcs-uri with type=private url of new key. Example

pkcs11:model=CryptoServer;manufacturer=Utimaco%20IS%20GmbH;serial=CS71084

3_0014; token=UTILUKS;id=%46;object=NEWPrivateKey;type=private  

15. Import the header.json file

# cryptsetup token import –-json-file header.json –-token-id 2 /dev/sdc1 

Importing token id information

16. Verify token id 2 is showing new key information using the command below.

# cryptsetup luksDump /dev/sdc1 

LuksDump output

LuksDump output

17. Remove token id 0 and 1 and verify with the command below.

# cryptsetup token remove –-token-id 0 /dev/sdc1 

# cryptsetup token remove –-token-id 1 /dev/sdc1 

Removing old token id

Removing old token id

18. Close the LUKS volume.

# cryptsetup luksClose newbackup 

lukscolse output

19. Attach the LUKS volume with systemd-cryptsetup.

# /usr/lib/systemd/systemd-cryptsetup attach luks /dev/sdc1 - pkcs11uri="auto" 

Attaching luks volume

For Auto-Atttachig and Auto-Mounting LUKS volume refer to section Auto-Attaching and AutoMounting LUKS Volume during Boot.