I'm trying to setup a partition and I'm trying to put the luks header on a USB device so I use the argument --header /path/to/usb-device, however I am still able to decrypt the device without the usb-device being mounted. How to stop cryptsetup from creating the luks header on the encrypted device ?

1 Answer 1


You must have used a wrong command somewhere... cryptsetup does not wantonly create LUKS headers all over the place... it only does what you tell it to and it usually asks for confirmation before doing so.


# truncate -s 8M luksheader luksdevice
# cryptsetup luksFormat --header luksheader luksdevice

This will overwrite data on luksheader irrevocably.

Are you sure? (Type uppercase yes): YES
Enter passphrase: 
Verify passphrase: 

# file -s luks*
luksdevice: data
luksheader: LUKS encrypted file, ver 1 [aes, xts-plain64, sha256] UUID: …

As you can see, there is no LUKS header on the luksdevice afterwards. If there is one then it was already there before.

You can also just luksFormat the external device/file directly without ever specifying the "encrypted device" (that only really matters on luksOpen).

Simplified example:

# cryptsetup luksFormat luksheader

This is almost equivalent to the more complicated command above, the only difference is in the Payload offset you can see in luksDump. If the header was created as external header in the first place this offset should be 0, otherwise it's something like 4096 (2 MiB) thereabouts.

Any LUKS header works as external header if you so desire, and leaving the Payload offset intact has its advantages. If you ever decide to change your setup you could just put the external header back onto the original device (or vice versa, switch to external header for an existing device).

  • Very interesting answer. I realized that I was using a device that I already encrypted few month before with the same passphrase hence my confusion. I thought that luksFormat was overwriting the device with random bits too. When you say that payload offset is different, you mean that both luksheaders are the same but the luksdevices are offseted differently right ? Well that and the fact that the luks headers account for that offset I guess. Commented Jul 26, 2016 at 16:43
  • @ChiseledAbs yup, just so Commented Jul 26, 2016 at 16:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .