CRYPTSETUP-REENCRYPT(8) (NAME) cryptsetup-reencrypt - LUKS2 (SYNOPSIS) cryptsetup reencrypt [<>] <> --active-name <> [<_>] (DESCRIPTION) LUKS. : o (reencrypt) o (reencrypt --encrypt/--new/-N) o (reencrypt --decrypt) <> --active-name <> ( LUKS2) . reencrypt cryptsetup ( ) . reencrypt LUKS (in-place) . ( ) (cipher) (cipher mode) (sector size) ( LUKS2) . luksChangeKey reencrypt ( ) . SIGINT ( ctrl+c) . SIGTERM ( systemd ) . reencrypt luksFormat LUKS ( cryptsetup-luksFormat ). : cryptsetup-luksFormat(8). (encrypt) (decrypt) -- (plaintext) . LUKS . <> : [--batch-mode, --block-size, --cipher, --debug, --debug-json, --decrypt, --device-size, --disable-locks, --encrypt, --force-offline-reencrypt, --hash, --header, --hotzone-size, --iter-time, --init-only, --keep-key, --key-file, --key-size, --key-slot, --keyfile-offset, --keyfile-size, --tries, --timeout, --pbkdf, --pbkdf-force-iterations, --pbkdf-memory, --pbkdf-parallel, --progress-frequency, --progress-json, --reduce-device-size, --resilience, --resilience-hash, --resume-only, --sector-size, --use-directio, --use-random, --use-urandom, --use-fsync, --uuid, --verbose, --volume-key-file, --write-log]. LUKS2 (LUKS2 REENCRYPTION) <> cryptsetup dm <> . LUKS2 . reencrypt cryptsetup . --resilience --hotzone-size (datashift) : --reduce-device-size LUKS2 --header. ( ) . ( open) ( repair) . <_> encrypt <_> . (mount) . LUKS1 (LUKS1 REENCRYPTION) . LUKS1 ( dm-crypt ). : LUKS1 ( ). (OPTIONS) --align-payload < > ( --offset ) (payload) . cryptsetup . ( ) ( ) . LUKS (detached) . --header . (DEPRECATED) ( LUKS2) . --offset . --batch-mode, -q . ! --verify-passphrase . --block-size ( LUKS1) (MiB). . --cipher, -c <-> LUKS2: . LUKS1: . (encrypt) . (reencrypt) . "cipher_null" . cryptsetup --help . IV . ESSIV "plain64" . XTS -s . XTS . --debug --debug-json . # . --debug-json JSON LUKS2 . --decrypt ( ) . --device-size [] . ( ) . LUKS2: --reduce-device-size ( --device-size) (shift) . --device-size --reduce-device-size . : . --device-size . . S K/M/G/T ( KiB, MiB, GiB, TiB) KB/MB/GB/TB ( SI) . --disable-blkid blkid . --disable-keyring (keyring) dm-crypt . LUKS2 . --disable-locks . LUKS2 . LUKS2 (superuser) () . : cryptsetup ( /run ). --encrypt, --new, -N ( ) . --force-no-keyslots ( LUKS2) --volume-key-file --new-volume-key-file --volume-key-keyring --new-volume-key-keyring. LUKS2 . LUKS2 . cryptsetup-luksAddKey(8) . : ! keyring LUKS2 . --force-offline-reencrypt ( LUKS2) . LUKS2 ( ). . : ! / . --force-password LUKS. cryptsetup . pwquality.conf(5) passwdqc.conf(5) . --hash, -h <-> LUKS1: LUKS1 . LUKS1 . LUKS2: pbkdf PBKDF2 (--pbkdf ). --header < LUKS> (detached) LUKS . LUKS . --encrypt/--new ( ) . . LUKS2: (export) LUKS2 . . LUKS2 . . : ! (deadlock) . --help, -? . --hotzone-size ( LUKS2) (hotzone) . ( 50M). (hotzone) ( ) <> . LUKS2 . --init-only ( LUKS2) ( ) LUKS2 . --init-only . --iter-time, -i < > PBKDF LUKS . --keep-key LUKS2: . LUKS1: LUKS1 . . --key-file, -d . "-" stdin . (newline) . --key-file --key-slot ( LUKS ). cryptsetup . --keyfile-offset . --keyfile-size, -l . --help . . . --keyfile-offset . --key-size, -s LUKS2: . . . LUKS1: --new-key-size . --key-slot, -S <0-N> LUKS . ( ) . . LUKS . LUKS1 . LUKS2 LUKS2 . --keyslot-cipher <-> LUKS2 . --keyslot-key-size <> LUKS2 . --label <>, --subsystem <> LUKS2. . udev . --luks2-keyslots-size LUKS2 ( ) . . <> ( 128k). --luks2-metadata-size LUKS2 (JSON) . ( JSON ). LUKS2 : 16, 32, 64, 128, 256, 512, 1024, 2048 4096 . <> ( 128k). --new-key-size . . . /proc/crypto . /proc/crypto . LUKS1: LUKS ( ) . --reduce-device-size . --new-volume-key-file () . --new-key-size . : . . --new-volume-key-keyring < > () (keyring). . /proc/crypto . /proc/crypto . < > keyctl . %< >:< > . KEY IDENTIFIERS keyctl(1) . %< >: user ( ) . : . . --offset, -o < > . (encrypt) . --offset ( ) ( ). --align-payload . --pbkdf < PBKDF> (PBKDF) LUKS. PBKDF : pbkdf2 ( PBKDF2 RFC2898) argon2i Argon2i argon2id Argon2id ( Argon2 ). LUKS1 PBKDF2 ( ). PBKDF LUKS2 cryptsetup --help . PBKDF (dictionary) (brute-force) . . PBKDF2 ( ) . Argon2i/id ( ) ( ) . . (--iter-time) --pbkdf-memory . . --pbkdf-parallel CPU . PBKDF LUKS2 cryptsetup-luksDump(8) . --pbkdf-force-iterations --pbkdf-memory --pbkdf-parallel . . (OOM) . (embedded) . PBKDF: PBKDF2 ( ) . PBKDF2 . Argon2i Argon2id ( CPU) ( ) . . ( ) . ( ) --pbkdf-memory . ( CPU CPU ). : PBKDF . . . PBKDF . LUKS . Cryptsetup ( ) ( ) () . PBKDF . (swap) . (overcommit) . PBKDF (out-of-memory) cryptsetup . --pbkdf-force-iterations PBKDF (). LUKS/LUKS2 . --pbkdf . --pbkdf-memory PBKDF ( Argon2i/id ). PBKDF . PBKDF2 . --pbkdf-parallel PBKDF ( ). . PBKDF2 . --progress-frequency . --progress-json JSON . ( --progress-frequency) . JSON ( ): { "device":"/dev/sda", // "device_bytes":"8192", // / "device_size":"44040192", // / "speed":"126877696", // ( ) "eta_ms":"2520012", // "time_ms":"5561235" // / } JSON: JSON . --reduce-device-size . ( ). --device-size . : . -- . LUKS2: LUKS2 ( ). . LUKS2 ( ) ( ) . LUKS2 (--reduce-device-size 32M) . --device-size --reduce-device-size . LUKS1: . ( ) . --resilience ( LUKS2) checksum journal none . checksum: (checksum) . . journal: ( ). none: . . datashift ( --reduce-device-size). --resilience-hash ( LUKS2) "--resilience checksum" . sha256 . . --resume-only ( LUKS2) ( ) LUKS2 . --resume-only . . --sector-size ( LUKS2) . : . --force-offline-reencrypt . . . --timeout, -t (timeout) . . --key-file . . . --token-id LUKS2: ( ) LUKS2 . . LUKS2: PIN . ( PIN ) . --token-only LUKS2: LUKS2 . . LUKS2: . . LUKS2 PIN . --token-type LUKS2: ( ) LUKS2 . . LUKS2: . --token-id . LUKS2 PIN . --tries, -T . . --type LUKS ( ) ( ) . luks1 luks2 . --usage . --use-directio ( LUKS1) / (O_DIRECT) / . direct-io ( ) . --use-fsync ( LUKS1) fsync . . --use-random, --use-urandom . --uuid UUID UUID LUKS . LUKS1 ( ): UUID LUKS-UUID.[|log|org|new] . UUID UUID 12345678-1234-1234-1234-123456789abc. --verify-passphrase, -y . stdin . --version, -V . --volume-key-file , --master-key-file ( ) LUKS2: . --new-volume-key-file --new-volume-key-keyring . LUKS1: --new-volume-key-file . --write-log ( LUKS1) . . (EXAMPLES) LUKS2 --type luks2 . LUKS2 LUKS2 ( ). /dev/plaintext ( ): cryptsetup reencrypt --encrypt --type luks2 --reduce-device-size 32m /dev/plaintext_device LUKS2 ( ). /dev/plaintext . ( ): cryptsetup reencrypt --encrypt --type luks2 --device-size 1g --reduce-device-size 32m /dev/plaintext_device LUKS2 ( ) : cryptsetup reencrypt --encrypt --type luks2 --header my_luks2_header /dev/plaintext_device LUKS2 ( ): cryptsetup reencrypt --encrypt --type luks2 --init-only --reduce-device-size 32m /dev/plaintext_device my_future_luks_device : cryptsetup reencrypt --resume-only /dev/plaintext_device cryptsetup reencrypt --active-name my_future_luks_device LUKS2 LUKS2 ( ): cryptsetup reencrypt /dev/encrypted_device LUKS2 () . . cryptsetup reencrypt --token-id 3 /dev/encrypted_device LUKS2 'systemd-tpm2'. . cryptsetup reencrypt --token-type systemd-tpm2 /dev/encrypted_device LUKS2 LUKS2 ( ): cryptsetup reencrypt --decrypt --header /export/header/to/file /dev/encrypted_device LUKS2 ( ): cryptsetup reencrypt --decrypt --header detached-luks2-header /dev/encrypted_device LUKS2: cryptsetup reencrypt --resume-only --header luks2-hdr-file /dev/encrypted_device (REPORTING BUGS) cryptsetup . . --debug . (SEE ALSO) cryptsetup cryptsetup(8), integritysetup(8) veritysetup(8) CRYPTSETUP cryptsetup . cryptsetup 2.8.7 2026-07-21 CRYPTSETUP-REENCRYPT(8)