Does it make sense to combine ZFS with LUKS2 for completely random-looking encryption on HDDs ? (Without luks-header on the disk of course, header placed elsewhere). The goal is to make a HDD really look like random data, since as I've learned ZFS built-in encryption is still telling us that it's actually a ZFS encrypted volume you're looking at, instead of being really just random data.

If yes, what would you use ?

  • a) Rather a simple integrity-free LUKS2 format since ZFS is taking care of integrity in upper layer already, or
  • b) LUKS with integrity ? (It might cause double write lag, once because of integrity checksum creation on the lower layers and then again in ZFS layer, but not sure. And probably bring in a little more complication in case of a physical failure or bit rot).

What happens at all when a bit flip is happening on an integrity-free conventional LUKS device ? Will that logical LUKS sector appear as 1 bad sector on the mapper device ? (Which would then be sensed by ZFS in a mirror setup and corrected/replaced elsewhere on the mapper device, I assume).

Setup would be a zfs raidz1,raidz2, raidz3, or mirror with 2+ drives so not only error detection but correction is granted too. Debian 10, ZoL.

I might install a smaller decoy OS (W10, Ubuntu..) onto the first ~50GB and run it occassionally .. (placing the encrypted part just behind it onto remaining empty space).

This method would allow a HDD to look like a harmless newbie setup, I'm not sure I want to complicate my life with Veracrypt & Co. and I'd like to stick to ZFS because I simply love it. It's only the lack of unrecognizably-random-looking encryption in ZFS which makes me thinking about pushing a LUKS2 layer beneath it. (I believe more in distraction than in unbreakable encryption btw).

1 Answer 1


Firstly, neither LUKS nor ZFS are designed to provide plausible deniability. You can tweak and change things to hide things a bit, but it won't get past intentional scrutiny.

ZFS does checksumming, so you'd be wasting resources by using dm-integrity underneath.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.