How to be able to change the password to access data encrypted with AES-GCM, without reencrypting? Let's say you need to encrypt plaintext which is 1 TB big.
You have a password pwd. This very classical AES-GCM process is applied (pseudo code):
salt = 16 random bytes
key = PBKDF2(pwd, salt, count=1000*1000)  # key derivation function
nonce = 16 random bytes
ciphertext, tag = AES_GCM_cipher(key, nonce).encrypt(plaintext)    # by blocks in reality
save to disk:  
     salt | nonce | ciphertext | tag

Now if I suspect pwd to be compromised, and I want to change it to pwd_new, I have to restart the whole encryption process which might be long for 1 TB of data.
Question: which simple encryption scheme can I use, still using AES-GCM for the actual data, such that I can change the password without having to reencrypt/rewrite all the data?
(There are implementations of this for example in Microsoft BitLocker disk encryption, etc.)
This is case for the Fundamental theorem of software engineering which states:

&quot;We can solve any problem by introducing an extra level of indirection.&quot;

In this case what is usually done is introducing an extra randomly drawn intermediate key (usually called &quot;data encryption key, DEK&quot;).
You then encrypt the DEK with a key derived from your password (also sometimes called &quot;key encryption key, KEK&quot;) and whenever you want to change the password you simply rederive the KEK, decrypt the DEK and derive the KEK under the new password to encrypt the DEK with (also preferably using a fresh salt).