luks-header-backup · shipping

LUKS header backup

A LUKS header backup preserves the encryption metadata and keyslot area needed to recover a volume key with a matching credential.

Related Observatory article: LUKS header backup on hesela.com

The saved header is a separate key-access path. Later live passphrase changes or keyslot erasure do not update it. Its security relevance persists while the corresponding volume key protects data. [1]

Restoration replaces the target header and keyslots; compatible key size and data offset do not establish that a backup belongs to the intended payload. [2]

Hesela's cryptsetup 2.7.0 file experiment recovered the original key from saved LUKS1/LUKS2 headers after live-keyslot erasure. A foreign-header control also passed a password check while returning a different key from the target's original one; no payload restoration was tested. [3]

Relations

related

LUKS, LUKS keyslot, Backup, Cryptographic erase

Citations

1. cryptsetup v2.7.0: header backup and retained access (accessed 2026-10-21)
2. cryptsetup v2.7.0: header replacement and compatibility checks (accessed 2026-10-21)
3. Hesela: LUKS header lifetime and identity observations (accessed 2026-10-21)

JSON: /data/terms/luks-header-backup.json