Detached LUKS header (on USB) for an existing full-disk encryption device with Ubuntu

Question

I already have a /boot partition on a USB stick and a LUKS partition on my computer, which correspond to a fulldisk encryption scheme with Ubuntu 21 I want to put the header of my LUKS partition onto the USB (either on the /boot partition or on another new partition on my USB)

I have put the header (with cryptsetup luksHeaderBackup) in boot_header.luks on my boot partition (let say on device /dev/sda3) then in the crypttab file with the option header= I tried the following :

• /boot/boot_header.luks
• /dev/sda3/boot_header.luks
• /dev/sda3:/boot_header.luks and also /boot_header.luks:/dev/sda3 (to be sure)

and the same with the uuid of /dev/sda3 and also with /dev/disk/by-uuid/[uuid]

So I though the device sda3 wasn't mounted as it should be according to the doc of crypttab (if I understand it correctly)

Optionally, the path [of the file containing the header] may be followed by ":" and an /etc/fstab device specification (e.g. starting with "UUID=" or similar); in which case, the path is relative to the device file system root. The device gets mounted automatically for LUKS device activation duration only.

So I looked for mounting the boot partition before the execution of the cryptroot script with a custom script in local-bottom and init-bottom. And also as suggested here I tried to incorporate the header in the initramfs following this answer

But the result at boot time is always the same :

wrong value for 'header' option

I found that it was quite feasible with arch but is there a way to do the same with Ubuntu (without modifying an existing script like cryptroot) ?

Answer 1

As pointed out in the comments by @A.B the solution is a raw partition that contains the header instead of the header file inside a partition (which is a hassle due to the need to mount the filesystem first)

To copy the header (around 16MB for LUKS2) to a partition (/dev/sdb larger than the header size) two options.

• The first one is to copy the raw header with dd.

First, you need to find the offset of the data (since the header always starts at 0). For a LUKS device /dev/sda4, use cryptsetup luksDump /dev/sda4 and look for the ligne offset in the section Data segments. Then find the filesystem block size with stat -fc %s /dev/sda4. And Finally, dd if=/dev/sda4 of=/dev/sdb bs=<fs_block_size> count=<data_offset>

• The second one is to pack all the header data into a backup file that will be copied to the partition /dev/sdb.

Because having a backup file can lead to some security issues even if it is saved on your encrypted disk, it's better to create a ramdisk just for that file.

mkdir /tmp/header_backup
mount -t tmpfs -o size=512m tmpfs /tmp/header_backup
cryptsetup luksHeaderBackup /dev/sda4 --header-backup-file /tmp/header_backup/header.luks
dd if=/tmp/header_backup/header.luks of=/dev/sdb
umount /tmp/header_backup

Then in /etc/crypttab add the option header=/dev/sdb to the corresponding line (e.g sda4_crypt [UUID] none luks,discard,header=/dev/sdb)

To erase the old LUKS header : cryptsetup luksErase /dev/sda4. That only wipes the keyslots but keep all the metadata. If you want (it's not necessary) to completely wipe the header you will need to have another filesystem header on it in order to keep a UUID onto that partition. But be aware that completely wiping the LUKS header may not results in a secure erase depending on your storage device (SSD or HDD). For SSD it's possible that the deleted block will stay in a queue until the device need to allocate more space.

Otherwise to wipe the header : get the filesystem block size (<fs_block_size>) with stat -fc %s /dev/sda4, the LUKS data offset (<luks_data_offset>) with cryptsetup luksDump /dev/sdb, the UUID of the partition /dev/sda4 (<uuid_sda4>) and then :

dd if=/dev/urandom of=/dev/sda4 bs=<fs_block_size> count=<luks_data_offset>
mkfs.ext4 fs.img
tune2fs -U <uuid_sda4> fs.img
dd if=fs.img of=/dev/sda4

The partition /dev/sdb will have the same UUID that the LUKS one which may be a problem. You can change it without messing up the LUKS process with cryptsetup luksUUID /dev/sdb --uuid $(uuidgen)

And finally update the initramfs with update-initramfs -u -k all