How can I add a second passphrase to decrypt my laptop on-boot when I chose to install Ubuntu with FDE at install-time.

At the time of writing, there is only one way to choose to install Ubuntu with Full Disk Encryption (FDE) with the Ubuntu install .iso GUI, and that's by choosing to create an encrypted LVM.

I know the command to add an additional keyslot to a LUKS volume is:

cryptsetup luksAddKey /dev/<device>

...but the encrypted LVM setup that Ubuntu uses is a bit more complex. It shows I have three decrypted luks devices:

user@host:$ ls /dev/mapper
control  nvme0n1p3_crypt  vgxubuntu-root  vgxubuntu-swap_1

What is the command(s) that I should type to add an additional luks keyslot such that I can decrypt my laptop at boot-time with either of the two passphrases?

  • First, this is the default way that the Ubuntu installer sets up FDE encryption. AFAIK, it's the only way to enable FDE with a checkbox during an ubuntu installation without manually setting up partitions. Second, yes, LUKS by design has eight keyslots. So, for example, you can have up to 8 passphrases to decrypt the disk on-boot. The master key is absolutely not derived from the passphrase--that would be terribly insecure. See gitlab.com/cryptsetup/LUKS2-docs/blob/master/luks2_doc_wip.pdf Nov 30, 2020 at 21:31

1 Answer 1



The one that ends in _crypt is the luks device that you should execute cryptsetup luksAddKey against (minus the _crypt part). In your case, execute:

# inspect the drive, note that the 0th key slot is the only key slot in use
cryptsetup luksDump /dev/nvme0n1p3

# dump the existing header and make a safe backup on another encrypted system
cryptsetup --header-backup-file header_backup luksHeaderBackup /dev/nvme0n1p3

# add a second passphrase to the 1st keyslot
cryptsetup --key-slot 1 luksAddKey /dev/nvme0n1p3

After successfully adding a second passphrase to the 1st keyslot with the command above, it will be possible to boot the machine with either the first passphrase (in key slot #0) or the second passphrase (in key slot #1).


By default, the Ubuntu installer sets-up FDE by creating three partitions:

  1. An unencrypted fat32 bootloader
  2. An unencrypted ext4 boot volume
  3. An big encrypted luks volume

You can see this, for example, using lsblk against your disk:

root@host:~# lsblk /dev/nvme0n1
nvme0n1                259:0    0   477G  0 disk 
├─nvme0n1p1            259:1    0   512M  0 part  /boot/efi
├─nvme0n1p2            259:2    0   732M  0 part  /boot
└─nvme0n1p3            259:3    0 475,7G  0 part 
  └─nvme0n1p3_crypt    253:0    0 475,7G  0 crypt
    ├─vgxubuntu-root   253:1    0 474,8G  0 lvm   /
    └─vgxubuntu-swap_1 253:2    0   980M  0 lvm   [SWAP]

As you can see from the above output, the nvme0n1 disk has three partitions. Inside the last partition nvme0n1p3, there is a huge decrypted volume nvme0n1p3_crypt.

Moreover, inside of nvme0n1p3_crypt, there's two lvm volume groups vgxubuntu-root & vgxubuntu-swap_1.

The device that you want to execute the luksAddKey command against is the actual luks-encrypted partition on the disk at the lowest branch level in the lsblk tree. In this case, that's /dev/nvme0n1p3.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .