If I use LUKS encryption provided
--header=<file> option, will it be equivalent to using dm-crypt in terms of plausible deniability or will there still be a way to tell that the given partition is LUKS-encrypted, albeit doesn't contain the header?
If you use
--header then only data is written to the device. You can check that by creating a loop device and use
luksFormat once with and once without
--header. If you use that option then the encrypted device is not changed and the decrypted device is larger.
start cmd: # cd /tmp start cmd: # dd if=/dev/zero of=luks.img bs=1M count=100 start cmd: # dd if=/dev/zero of=luksheader bs=1M count=10 start cmd: # cryptsetup --force-password --header luksheader luksFormat /dev/loop0 start cmd: # cryptsetup --header luksheader luksOpen /dev/loop0 luks start cmd: # blockdev --getsz /dev/mapper/luks 204800 start cmd: # blockdev --getsz /dev/loop0 204800 start cmd: # dd if=/dev/loop0 bs=1K count=1 | od 0000000 000000 000000 000000 000000 000000 000000 000000 000000 * 0002000 start cmd: # cryptsetup luksClose luks start cmd: # cryptsetup --force-password luksFormat /dev/loop0 start cmd: # cryptsetup luksOpen /dev/loop0 luks start cmd: # blockdev --getsz /dev/mapper/luks 200704 start cmd: # dd if=/dev/loop0 bs=1K count=1 | command od 0000000 052514 051513 137272 000400 062541 000163 000000 000000 0000020 000000 000000 000000 000000 000000 000000 000000 000000 0000040 000000 000000 000000 000000 072170 026563 066160 064541 [...]
For LUKS archives:
What about creating a normal but decoy/fake LUKS header on the device? Follow along; I could run urandom (or other faster noise filling on the media) via the decoy header to completely noise fill using that decoy header.
Now I save that header to restore it when I want to. Next I create a new header with secure password and the create my filesystem and use it when I want to save files.
A little work but executable shell scripts would make this fast and easy. When I want to use the media I write the correct luks header to the media and have full access to the filesystem. When finished I wipe the header area and then write the decoy LUKS header back to the media. Would be super easy and fast with an executable shell script.
It would seem to me that if I opened the LUKS media using the decoy header that it would appear to be completely wiped and since there is no such a thing as hidden volumes the suspicion of such a move would not be high.
Just a thought.