hesela.devLUKS
LUKS is a disk-encryption format that records cryptographic parameters and key-management metadata, including keyslots used to unlock encrypted storage.
LUKS names a format, not a cipher. A LUKS2 header alone does not establish authenticated encryption. [1] A header backup and a passphrase valid for that backup may retain decryption access after the live keyslot is changed or removed, while the data still use the corresponding volume key. [2]
Relations
- related
- dm-crypt, xts-aes, authenticated-encryption, backup, cryptographic-erase
Limitations
- Recovery copies of the header/keyslots are security-sensitive, not harmless configuration exports. [2]