luksbox revoke

Disable a keyslot without rotating the MVK.

luksbox revoke [OPTIONS] --slot <N> <PATH>

Zeroes a slot's contents (kind = Empty, all fields cleared). The revoked slot can no longer unlock the vault; remaining slots are unaffected.

Examples

# Revoke slot 1 (typically the second-enrolled key)
luksbox revoke my.lbx --slot 1
# You'll be asked to unlock the vault first (passphrase by default;
# --fido2, --tpm2, --sep, ... to unlock with another slot).

# With the vault's rollback anchor (recommended on header format v3)
luksbox revoke my.lbx --slot 1 --anchor /media/usb/my.anchor

To find slot indexes:

luksbox info my.lbx
# keyslots:
#   0: passphrase  (Argon2id m=262144 KiB t=3 p=4)
#   1: fido2        (cred_id=...)

Important: revoke does NOT rotate the MVK

After revoking a slot:

That slot's KEK can no longer derive the MVK from the on-disk ciphertext (the ciphertext is gone).
BUT, anyone who already extracted the MVK at some point (e.g. an attacker who briefly had your YubiKey) still has it - and the MVK still decrypts every file in the vault.

If you suspect a key was compromised, follow revoke with rotate-mvk:

luksbox revoke my.lbx --slot 1
luksbox rotate-mvk my.lbx

rotate-mvk generates a fresh MVK, re-encrypts every file under it, and re-wraps every remaining keyslot under the new MVK. After that, the previously-extracted MVK is useless against the vault.

Old header backups bring a revoked slot back

revoke does not change the MVK, so a copy of the header saved before it (a header-backup, a backup or cloud copy of the vault) is still valid and still contains the revoked slot. Put back over the vault, it makes the revoked credential work again.

On a header format v3 vault (the default since 0.6.0), revoke gives the header a new generation. Run it with --anchor so the anchor records it: an open with --anchor then refuses the older header. Since 0.6.0 revoke checks and advances the anchor like every command that unlocks a vault.
On a header format v2 vault, nothing detects it. Upgrade with upgrade-header, or follow the revoke with rotate-mvk: an old header no longer opens a rotated vault.

Take a new header-backup after revoking.

Revoking the last slot

revoke does not stop you from revoking the only remaining keyslot, and nothing can open the vault afterwards. Check luksbox info first, and add a new slot before you remove the last one you have.