2

Say I have a LUKS encrypted USB (full disk). I am looking for a way to hide the fact that it is a LUKS device.

Which strategy would you use to hide the fact that my USB is a LUKS device?

My approach would be to alter the LUKS header to make the LUKS header unrecognizable (and be able to go back easily).

What about exchanging a define portion of the bits of the header for instance?


PS: Say I don't want to use Truecrypt

3

So, without opening the whole topic of deniable encryption (and the cryptsetup FAQ has a section dedicated to that topic too) and since you're asking to simply hide the LUKS device (if that's sufficient), I'd use the luksHeaderBackup and luksHeaderRestore options from cryptsetup(8).

Example for an already created LUKS device with an ext4 file system on it:

# file -Ls /dev/vg0/lv1 /dev/mapper/test
/dev/vg0/lv1:     LUKS encrypted file, ver 1 [aes, cbc-plain, sha1] UUID: 0b52a420-742d-4f0f-87f1-29c51d8b2232
/dev/mapper/test: Linux rev 1.0 ext4 filesystem data, UUID=840fc046-df2f-428d-8069-faa239c2f9f3 (extents) (large files) (huge files)

Backup the LUKS header:

# cryptsetup luksHeaderBackup /dev/vg0/lv1 --header-backup-file test.bkp
# ls -go test.bkp 
-r-------- 1 1052672 Dec 17 18:41 test.bkp

Now we can overwrite this many bytes of the beginning of the LUKS partition. Our root partition is formatted with ext4 as well, let's just use that:

# dd if=/dev/sda1 of=/dev/vg0/lv1 bs=1 count=1052672
# file -Ls /dev/sda1 /dev/vg0/lv1
/dev/sda1:    Linux rev 1.0 ext4 filesystem data, UUID=f0cf7fa2-9977-4e1f-938d-1e8f71934cce (needs journal recovery) (extents) (large files) (huge files)
/dev/vg0/lv1: Linux rev 1.0 ext4 filesystem data, UUID=f0cf7fa2-9977-4e1f-938d-1e8f71934cce (needs journal recovery) (extents) (large files) (huge files)

Now our LUKS partition looks like our root partition. Hm, they both have now the same header, even the UUID matches, maybe a bit too similar. Of course we could have filled the LUKS partition with something else, you get the point.

The important part is to backup the LUKS headerfile (test.bkp), because without that we won't be able to unlock the partition again.

Once you feel safe to unlock the LUKS partition again, get the backup file (maybe from your own USB drive) and simply restore the header:

# cryptsetup luksHeaderRestore /dev/vg0/lv1 --header-backup-file test.bkp

...and unlock the partition again.

  • could this process be used to backup your LUKS headers in case of just general LUKS header corruption? e.g from header damage caused by repeatedly shutting down your computer without cryptsetup closeing your LUKS partition? – the_velour_fog Dec 18 '16 at 7:17
  • @the_velour_fog Yes, of course - that's the original reason luksHeaderBackup was invented for! The cryptsetup(8) manpage even states "Damaging the LUKS header is something people manage to do with surprising frequency." So yes - backing up partition headers (to a safe location) is a good idea. – ckujau Dec 18 '16 at 7:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.