To verify whether your encrypted volume uses PBKDF2 or Argon2id, execute the following command.

Replace [partition] with the partition name found in step 1.6.

cryptsetup luksDump /dev/[partition]

In the output:

• Version indicates the version of LUKS, either 1 or 2.

• PBKDF indicates the key derivation function, either pbkdf2 or argon2id.

If your encrypted volume already uses LUKS2 and Argon2id, you can stop here.

Execute the following command to do a backup of your LUKS1 header.

Replace [partition] with the partition name found in step 1.6.

cryptsetup luksHeaderBackup /dev/[partition] --header-backup-file /home/amnesia/luks1header

If something goes wrong, you will be able to restore your LUKS1 header from this backup with:

cryptsetup luksHeaderRestore /dev/[partition] --header-backup-file /home/amnesia/luks1header

To update your LUKS header to LUKS2, execute the following command.

Replace [partition] with the device name found in step 1.6.

cryptsetup convert /dev/[partition] --type luks2

To verify that Argon2id is the new key derivation function, execute the following command again.

Replace [partition] with the partition name found in step 1.6.

cryptsetup luksDump /dev/[partition]

In the output, verify that:

• The Version is 2 and not 1.

• The PBKDF is argon2id and not pbkdf2.

Try to unlock your encrypted volume.