Beheaded LUKS volume pathology

Mistave <[email protected]> Fri, 2 Feb 2024 09:12:37 +0100
Newsgroups dev.linux.lists.cryptsetup
Message-ID <[email protected]>
Hello, hypothetical question.

Suppose there is an empty and functional hard drive that has been 
overwritten with random data. Then, an encrypted LUKS/2 volume with 
detached header is created on the entire device by using cryptsetup with 
a strong passphrase (defaults to LUKS2 header on newer distros, but the 
question is valid for both LUKS versions). The /dev/sdb is the HDD, and 
the luksheader.bin file will be later put on a small USB flash drive.

# cryptsetup -h sha512 -s 512 --use-random -y --header 
/root/luksheader.bin luksFormat /dev/sdb

Provided, that an adversary obtains physical access to both devices (the 
HDD and the USB flash drive), how difficult is it for them to 
forensically link the two pieces together?

How easy is it to figure out that *this* particular detached LUKS header 
belongs to *that* particular hard drive (assuming there are other HDD's 
present with "random data" on them, and the USB flash drive has multiple 
detached LUKS/2 headers on it that may belong to different devices)?

Does the LUKS/2 header contain any identifiable or relatable metadata to 
the volume body it belongs to?

Thanks in advance.