Beheaded LUKS volume pathology
Mistave <[email protected]> Fri, 2 Feb 2024 09:12:37 +0100
| Newsgroups | dev.linux.lists.cryptsetup |
|---|---|
| Message-ID | <[email protected]> |
Hello, hypothetical question. Suppose there is an empty and functional hard drive that has been overwritten with random data. Then, an encrypted LUKS/2 volume with detached header is created on the entire device by using cryptsetup with a strong passphrase (defaults to LUKS2 header on newer distros, but the question is valid for both LUKS versions). The /dev/sdb is the HDD, and the luksheader.bin file will be later put on a small USB flash drive. # cryptsetup -h sha512 -s 512 --use-random -y --header /root/luksheader.bin luksFormat /dev/sdb Provided, that an adversary obtains physical access to both devices (the HDD and the USB flash drive), how difficult is it for them to forensically link the two pieces together? How easy is it to figure out that *this* particular detached LUKS header belongs to *that* particular hard drive (assuming there are other HDD's present with "random data" on them, and the USB flash drive has multiple detached LUKS/2 headers on it that may belong to different devices)? Does the LUKS/2 header contain any identifiable or relatable metadata to the volume body it belongs to? Thanks in advance.