As a supplement to the answer from @frostschutz about cryptsetup reencrypt:
cryptsetup reencrypt is a secure way to renew a LUKS container without having to move the data contained within.
This saves an enormous amount of time and space.
The data does not need to be extracted, the container does not need to be recreated, and the data does not need to be copied back.
It is used to, add, remove, change passwords or keyfiles.
To upgrade older LUKS containers to more modern, secure algorithms.
Or to change the size of an encrypted container if the underlying partition has been enlarged.
ALWAYS BE SURE YOU HAVE RELIABLE BACKUP BEFORE USING THIS ACTION ON LUKS DEVICE.
Cryptsetup reencrypt action can be used to change reencryption parameters, which otherwise require full on-disk data change (re-encryption). The reencrypt action reencrypts data on the LUKS device in-place.
You can regenerate volume key (the real key used in on-disk encryption unlocked by passphrase), cipher, cipher mode or encryption sector size (LUKS2 only).
More sources: