1

If I format partition with dm-crypt does its entry in partition table suggest somehow that this partition is encrypted or for someone from outside it looks like regular partition with random noise stored on it? My goal is to encrypt partition and to make in undistinquishable from regular partition that was just formatted or erased by cat /dev/urandom > /dev/sda1.

  • Having a partition that looks like random noise doesn't hide the fact that it's encrypted. No one carries random noise around. – Gilles 'SO- stop being evil' Dec 12 '13 at 23:00
5

Plain DM-Crypt looks like random, provided you are using a proper cipher. However you will have to remember all encryption settings by yourself.

DM-Crypt/LUKS has a distinct header which remembers the encryption settings for you and manages several pass phrases; however you can also put this header in an external file instead. As long as it's available at boot time and you don't ever lose it...

As a first step you should always scrub the device (shred -n 1 /dev/eraseme or similar) to get rid of old, non-random data.

  • Does the LUKS header resides in partition table? I think it is stored at the beginning of partition so if it does not have any magic numbers stored in it used to recognize that it is luks header it would still look like random data. The question is does it have some magic numbers or not? – Trismegistos Dec 12 '13 at 12:32
  • To answer my own question. DM-Crypt documentation states that in case of LUKS header being stored on disk: "Disadvantages are that it is readily obvious there is encrypted data on disk" – Trismegistos Dec 12 '13 at 12:42
  • The header is obvious. Your options are no header at all (DM-Crypt without LUKS), or external header (LUKS with header on USB stick or what ever). You might also want to read the section on plausibile deniability in the cryptsetup FAQ. – frostschutz Dec 12 '13 at 12:44
  • I read It. Header start with "LUKS" magic string so it is really obvious. The deniability is good idea and it could be little bit longer section. There are also other options like encrypting header with simple cipher ;D – Trismegistos Dec 12 '13 at 12:59
3

Yes. Look at cryptsetup FAQ section 2.3 paragraph titled What is the difference between "plain" and LUKS format?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.