{
  "slug": "luks",
  "term": "LUKS",
  "aliases": [
    "Linux Unified Key Setup"
  ],
  "definition": "LUKS is a disk-encryption format that records cryptographic parameters and key-management metadata, including keyslots used to unlock encrypted storage.",
  "note": "LUKS names a format, not a cipher. A LUKS2 header alone does not establish authenticated encryption. [cryptsetup-source] A header backup and a passphrase valid for that backup may retain decryption access after the live keyslot is changed or removed, while the data still use the corresponding volume key. [luks-header]",
  "status": "shipping",
  "advantages": [],
  "limitations": [
    {
      "text": "Recovery copies of the header/keyslots are security-sensitive, not harmless configuration exports.",
      "citationIds": [
        "luks-header"
      ]
    }
  ],
  "related": [
    "dm-crypt",
    "xts-aes",
    "authenticated-encryption",
    "backup",
    "cryptographic-erase"
  ],
  "supersedes": [],
  "supersededBy": [],
  "firstSeen": null,
  "lastSeen": null,
  "citations": [
    {
      "id": "cryptsetup-source",
      "title": "cryptsetup v2.8.1: LUKS extension and experimental authenticated disk encryption",
      "url": "https://gitlab.com/cryptsetup/cryptsetup/-/raw/v2.8.1/man/cryptsetup.8.adoc",
      "accessed": "2026-10-15"
    },
    {
      "id": "luks-header",
      "title": "cryptsetup-luksHeaderBackup(8): header backups and retained decryption access",
      "url": "https://man7.org/linux/man-pages/man8/cryptsetup-luksHeaderBackup.8.html",
      "accessed": "2026-10-15"
    },
    {
      "id": "hesela-encryption",
      "title": "Hesela: Encryption is not authentication",
      "url": "https://hesela.com/analyses/checksums-identity-and-lost-writes/#encryption-boundaries",
      "accessed": "2026-10-15"
    }
  ],
  "updated": "2026-10-15"
}