Re: Beheaded LUKS volume pathology

[Milan Broz <gmazyland@gmail.com>]

On 2/3/24 13:52, Mistave wrote:
> On 2/2/24 11:16, Milan Broz wrote:
> 
>> So if the user does not deliberately write some information elsewhere
>> (like pair detached header and data device using storage UUID
>> in /etc/crypttab), there should be no information that logically connects
>> the detached LUKS header and data device (for default config).
>>
> 
> Hello,
> 
> So, just to confirm, there is no metadata present in the LUKS header
> that would allow an adversary to perform guesswork (such as the size of
> the encrypted volume)?

For LUKS1, there is no attribute to store device size in the header.

For LUKS2, we can store a fixed size, but the default format
set it to "dynamic", the size is determined according to data device size.

See luksDump, for dynamic size you should see

Data segments:
   0: crypt
...
         length: (whole device)

Milan

  
> For example, if I have a bunch of encrypted disks with detached headers,
> and only one of them is 10TB, but the rest are 1TB. You're saying
> there's no way that a particular header can be singled out based on
> guesswork because it's the only header that has a bigger encrypted
> volume body?
> 
> How does an encrypted volume know what size it's supposed to be? Does it
> always span across the entire partition or block device?
> 
> 
> Kind regards!
> M.
>