Re: How to protect header and on.... paper?

Hi,

On 6/3/23 09:29, Felix Rubio wrote:
> I have setup a my FDE using LUKS, and tying the decryption key to my
> TPM+recovery key. Now I am wondering: I know I can get a backup of the
> LUKS header on a file, store it somewhere and done... but what happens
> if the USB is corrupted by the time I need it? what if I put it on an
> optical disk and has been scratched? This kept me thinking: is there any
> possibility/process to have the required information for the header
> printed on paper, that could be stored on a safe?

You cannot have full text backup of LUKS keyslot metadata, but you can dump
volume encryption key that allows mapping data device without LUKS header.

Actually, paper backup was motivation for --dump-volume-key option, use:
  cryptsetup luksDump --dump-volume-key <device>

(in very old cryptsetup use --dump-master-key instead)

There is no automated script that maps dm-crypt automatically from this
info, but it is quite trivial and should contain all info dm-crypt needs
to decrypt data area.


You can also dump metadata keyslot info with luksDump command, for LUKS2
even in JSON format:
  cryptsetup luksDump --dump-json-metadata <device>

NOTE - this contains only configuration, not the binary area content
of keyslots (but it can be useful anyway).

Milan