Open Skyfold opened 2 months ago
Can you just add a line with a number for iterations?
Any ideas what could have gone wrong and any hope I might decrypt my hard drive within my lifetime?
I think you probably can, as long as you know the correct key length and iterations values, but you'll need to do some reverse engineering. I sometimes follow the README from the bottom up when I mess something up. I only created the script because I got tired of copy/pasting the same commands over and over
I know the correct key length from my configuration.nix
and I set the iterationStep
to 0, so it should have been whatever I initially set it to during setup. I used the commands from the Maintenance section in the wiki since they pipe the output to avoid command substitution: ignored null byte in input
. Just to be sure I tested with multiple iterations (0, 10, 100, ..., 1000000). Nothing has worked.
The reason I cannot decrypt my drive is most likely because the salt is incorrect. Think about it. I upgraded my system to nixos-24.05 and rebooted successfully. It was the next reboot that failed. The problem is not the decryption on nixos-24.05, it was the process that updates the salt and LUKS authentication key. My guess is that it failed part way. Either the LUKS authentication key was never updated or the salt was improperly updated (why else is the iterations missing).
If you want to prevent this happening, the previous salt should be kept and some logs written to know what happened. However, the better option is to create an encrypted backup of the LUKS authentication key using a provided public key on the boot partition. That way, when the update fails part way, you can still have a chance to decrypt the drive.
I've successfully been using this setup for awhile now, but after updating from nixos-23.11 to nixos-24.05 it fails to boot from any version. Any ideas what could have gone wrong and any hope I might decrypt my hard drive within my lifetime?
Specifically, I booted nixos-24.05 successfully, but then failed on the reboot. That means, nixos-24.05 was able to create the luks key from the salt created in a previous version, but something about the new salt from nixos-24.05 is causing my issue.
I did try to manually decrypt from the nixos installer using the maintenance instructions, but no luck.
There are two important details:
awk 'NR == 2 {print}' < /mnt/boot/crypt-storage/default
returns nothing (zero bytes).awk 'NR == 1 {print}' < /mnt/boot/crypt-storage/default
is not the same as/mnt/boot/crypt-storage/default
according to diff.