1

I'm trying to setup a partition and I'm trying to put the luks header on a USB device so I use the argument --header /path/to/usb-device, however I am still able to decrypt the device without the usb-device being mounted. How to stop cryptsetup from creating the luks header on the encrypted device ?

1

You must have used a wrong command somewhere... cryptsetup does not wantonly create LUKS headers all over the place... it only does what you tell it to and it usually asks for confirmation before doing so.

Example:

# truncate -s 8M luksheader luksdevice
# cryptsetup luksFormat --header luksheader luksdevice

WARNING!
========
This will overwrite data on luksheader irrevocably.

Are you sure? (Type uppercase yes): YES
Enter passphrase: 
Verify passphrase: 

# file -s luks*
luksdevice: data
luksheader: LUKS encrypted file, ver 1 [aes, xts-plain64, sha256] UUID: …

As you can see, there is no LUKS header on the luksdevice afterwards. If there is one then it was already there before.

You can also just luksFormat the external device/file directly without ever specifying the "encrypted device" (that only really matters on luksOpen).

Simplified example:

# cryptsetup luksFormat luksheader

This is almost equivalent to the more complicated command above, the only difference is in the Payload offset you can see in luksDump. If the header was created as external header in the first place this offset should be 0, otherwise it's something like 4096 (2 MiB) thereabouts.

Any LUKS header works as external header if you so desire, and leaving the Payload offset intact has its advantages. If you ever decide to change your setup you could just put the external header back onto the original device (or vice versa, switch to external header for an existing device).

  • Very interesting answer. I realized that I was using a device that I already encrypted few month before with the same passphrase hence my confusion. I thought that luksFormat was overwriting the device with random bits too. When you say that payload offset is different, you mean that both luksheaders are the same but the luksdevices are offseted differently right ? Well that and the fact that the luks headers account for that offset I guess. – ChiseledAbs Jul 26 '16 at 16:43
  • @ChiseledAbs yup, just so – frostschutz Jul 26 '16 at 16:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.