Check highest AES encryption supported

Before I can help you further, I need some clarification on your ultimate goal. Particularly, what do you mean or hope to intend with “creating a new FDE” and “change the passphrase”? Are you looking to change the password that you use unlock your computer’s encrypted drive when you power it on?

I ask this because you may be intending to or want to perform a cryptsetup-reencrypt, which will also reset the LUKS2 master key, and not simply change the passphrase to unlock your computer’s encrypted drive at boot. Given that you receive this laptop prebuilt, I’d probably recommend this step as long as you are comfortable with the possible risks. This resets the “master_key” that is used in the background by LUKS.

Unfortunately, I cannot find a good reference at the moment to explain this. But, there is technically a master_key that is actually used to encrypt and decrypt your disk. The passphrase (and keyslots) that you enter to unlock your encrypted drive are actually unlocking the master_key, which is used to handle drive decryption/encryption.

Passphrase (keyslot) → master_key → LUKS data

Changing your passphrase will not change the master_key. The risk here is that you received this laptop from Star Labs and they may have had access to copy this master_key. You can use cryptsetup-reencrypt to change/reset the master_key.

2 Likes