It seems that one of the weak points in LUKs encryption is that the LUKs header can be a single point of failure if you do not create a backup header for it.

My question is: What methods of securing your backup LUKs header do you take to ensure it is not recovered by someone else?

Possible options that come to mind for me:

  1. Hiding them in a safe location or leaving it with a trusted third party

  2. Encrypting them

  3. Using stenography to hide them

A combination of all three?

1 Answer 1


The threat from a backup LUKS header is that an attacker who obtains a copy of it and the password for one of the key slots can access the volume's data even if you subsequently change that password. However, they can also do this if they gain access to the encrypted volume itself.

Basically, protect the backup header in the same way you would protect the encrypted volume, and don't worry too much. This isn't a major attack vector.

  • How would they be able to do this with the encrypted volume itself?
    – P0LYmath
    Nov 5, 2014 at 7:15
  • The LUKS header backup is just a copy of the header area of the encrypted volume. If the attacker gets access to the volume, they can perform a backup of the header without needing to know any of the passwords, or they can just work with the volume's header area directly.
    – Mark
    Nov 5, 2014 at 9:27
  • When you say gains access to the encrypted volume, you mean after it's been unencrypted and opened right? Or do you mean that the header can be recovered from a currently encrypted volume?
    – P0LYmath
    Nov 5, 2014 at 16:47
  • The header can be recovered from a currently encrypted volume. Note that most of the header (key slots, master key, etc.) is itself encrypted, so there's no security risk from this.
    – Mark
    Nov 5, 2014 at 20:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.