Prepare storage device from zero#

cryptsetup luksFormat /dev/sdx
cryptsetup luksOpen /dev/sdx cryptoblob
mkfs.ext4 /dev/mapper/cryptoblob

Test slot/passphrase#

cryptsetup --verbose open --test-passphrase /dev/sdx

Change volume password#

cryptsetup luksChangeKey -S 0 /dev/sdx

Update old LUKS KDF for safer one#

Older LUKS volumes can have unsafe/poor key derivation function in use.

cryptsetup luksHeaderBackup /dev/sdx --header-backup-file /tmp/luksheader

cryptsetup luksDump /dev/sdx

# If type 1 (old):
cryptsetup convert /dev/sdx --type luks2
cryptsetup luksConvertKey /dev/sdx --pbkdf argon2id

# If goofen uppen, restore old header:
cryptsetup luksHeaderRestore /dev/sdx --header-backup-file /tmp/luksheader