Does it make sense to combine ZFS with LUKS2 for completely random-looking encryption on HDDs ? (Without luks-header on the disk of course, header placed elsewhere). The goal is to make a HDD really look like random data, since as I've learned ZFS built-in encryption is still telling us that it's actually a ZFS encrypted volume you're looking at, instead of being really just random data.

If yes, what would you use ?

  • a) Rather a simple integrity-free LUKS2 format since ZFS is taking care of integrity in upper layer already, or
  • b) LUKS with integrity ? (It might cause double write lag, once because of integrity checksum creation on the lower layers and then again in ZFS layer, but not sure. And probably bring in a little more complication in case of a physical failure or bit rot).

What happens at all when a bit flip is happening on an integrity-free conventional LUKS device ? Will that logical LUKS sector appear as 1 bad sector on the mapper device ? (Which would then be sensed by ZFS in a mirror setup and corrected/replaced elsewhere on the mapper device, I assume).

Setup would be a zfs raidz1,raidz2, raidz3, or mirror with 2+ drives so not only error detection but correction is granted too. Debian 10, ZoL.

I might install a smaller decoy OS (W10, Ubuntu..) onto the first ~50GB and run it occassionally .. (placing the encrypted part just behind it onto remaining empty space).

This method would allow a HDD to look like a harmless newbie setup, I'm not sure I want to complicate my life with Veracrypt & Co. and I'd like to stick to ZFS because I simply love it. It's only the lack of unrecognizably-random-looking encryption in ZFS which makes me thinking about pushing a LUKS2 layer beneath it. (I believe more in distraction than in unbreakable encryption btw).

1 Answer 1


Firstly, neither LUKS nor ZFS are designed to provide plausible deniability. You can tweak and change things to hide things a bit, but it won't get past intentional scrutiny.

ZFS does checksumming, so you'd be wasting resources by using dm-integrity underneath.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .