{
  "slug": "luks-header-backup",
  "term": "LUKS header backup",
  "aliases": [],
  "definition": "A LUKS header backup preserves the encryption metadata and keyslot area needed to recover a volume key with a matching credential.",
  "note": "The saved header is a separate key-access path. Later live passphrase changes or keyslot erasure do not update it. Its security relevance persists while the corresponding volume key protects data. [luks-backup-v270]\n\nRestoration replaces the target header and keyslots; compatible key size and data offset do not establish that a backup belongs to the intended payload. [luks-restore-v270]\n\nHesela's cryptsetup 2.7.0 file experiment recovered the original key from saved LUKS1/LUKS2 headers after live-keyslot erasure. A foreign-header control also passed a password check while returning a different key from the target's original one; no payload restoration was tested. [hesela-luks-observations]",
  "status": "shipping",
  "advantages": [],
  "limitations": [],
  "related": [
    "luks",
    "luks-keyslot",
    "backup",
    "cryptographic-erase"
  ],
  "supersedes": [],
  "supersededBy": [],
  "firstSeen": null,
  "lastSeen": null,
  "citations": [
    {
      "id": "luks-backup-v270",
      "title": "cryptsetup v2.7.0: header backup and retained access",
      "url": "https://gitlab.com/cryptsetup/cryptsetup/-/raw/v2.7.0/man/cryptsetup-luksHeaderBackup.8.adoc",
      "accessed": "2026-10-21"
    },
    {
      "id": "luks-restore-v270",
      "title": "cryptsetup v2.7.0: header replacement and compatibility checks",
      "url": "https://gitlab.com/cryptsetup/cryptsetup/-/raw/v2.7.0/man/cryptsetup-luksHeaderRestore.8.adoc",
      "accessed": "2026-10-21"
    },
    {
      "id": "hesela-luks-observations",
      "title": "Hesela: LUKS header lifetime and identity observations",
      "url": "https://hesela.com/analyses/checksums-identity-and-lost-writes/#luks-header-lifetime",
      "accessed": "2026-10-21"
    }
  ],
  "updated": "2026-10-21"
}