How do you store your luks headers?
Posted by EverythingsBroken82@reddit | linux | View on Reddit | 22 comments
Title says all. It's less about extraction/restore, but WHERE do you keep the headers? usb disks outside of your house? cloud storage? base64 encoded in some keepass file? in some other (encrypted?) format?
I mean, exporting and placing them besides your encrypted drives does not make THAT much sense, no?
nintendiator2@reddit
I store them in a hidden file in my $HOME in the encrypted drive so that they are extra safe.
ugly-051@reddit
Certainly sounds it 😂
FryBoyter@reddit
I save the headers as attachments in my KeepassXC database, which I synchronise via my own Nextcloud instance on several devices. This database, in turn, I backup with Borg, and thus encrypted, on external hard drives as well as in the so-called cloud.
NefariousnessFuzzy14@reddit
Probably this is me being ignorant but isn't the passphrase enough What do you need the luks headers for
suprjami@reddit
I presume it's to protect against header corruption making the entire encrypted drive useless. You can restore such a header from backup file with
cryptsetup luksRestore.NefariousnessFuzzy14@reddit
Nice thanks I'll look into that So if I understand correctly is per exemple I have a 50 gb encrypted drive And for some reason the first gb was corrupted I can still recover the other 49 gb theoretically
Booty_Bumping@reddit
The LUKS header is only 16 MiB, so if the first gigabyte has been corrupted, then you should also be worried about the filesystem header also being corrupted. It's not impossible to recover data from a filesystem that has had its structure erased, but it's very difficult.
NefariousnessFuzzy14@reddit
That makes moresense to me
suprjami@reddit
No.
If you have an encrypted drive, and the encryption header becomes corrupt, you've lost the entire drive.
If you have a backup of the encryption header, you can attempt recovery.
The success of this depends on the corruption being confined to only the encryption header.
NefariousnessFuzzy14@reddit
Ahh nice thanks
Booty_Bumping@reddit
One reason you might want to have a separate header entirely is for plausible deniability. The header is not random data and is easily identifiable, so if an attacker, law enforcement, or a court sees it they won't be able to prove that the drive has anything useful on it. Just beware that $5 wrench guy will still get you.
Unhappy_Tune1349@reddit
I would also want to know
PossiblyLinux127@reddit
My ssd
Should I be backing them up?
LionSuneater@reddit
I attach them inside a Bitwarden entry.
fdjfdslk@reddit
KeepassXC with redundant backups.
mactroneng@reddit
Fucking hell, I didn't know I could attack files to entries in the database, that's awesome.
Mean_Einstein@reddit
Guess what, you can even attach your ssh private keys and have them added to your ssh keyring on login
EverythingsBroken82@reddit (OP)
do you encode them with base64 beforehand? or how do you copy them into keepassxc?
fdjfdslk@reddit
Attachment.
jlobodroid@reddit
First I encrypt with axCrypt, after store in oneDrive cloud 2FA
IceOleg@reddit
They go into my cloud backup, as well as an encrypted tar file that I have spread about in a few places. The tar file also has other critical secrets - gpg key revocation certificate, backup codes for online services, KeePass keyfiles and DB, and so on.
AnsibleAnswers@reddit
I store mine in Bitwarden.