LUKS header and lvm on bootable computer

Question

I am trying to achieve LUKS deniability on a Debian computer, but I'm stuck. I installed Debian on a computer, and formatted the hd in this way:

• sda is totaly filled by sda1 partition which is LUKS
• inside this LUKS container (sda1) there is a lvm group with 3 volumes: the root, the home and the swap
• sdb1 is /boot (unencrypted partition) (on an detachable USB stick)

Now I want to "move" the LUKS header to achieve deniability. So I backup the header on the stick (on initramfs):

cryptsetup luksHeaderBackup /dev/sda1 --header-backup-file /etc/luks_header/sda1-header-backup

I hooked a script to put the header accessible via initramfs in /usr/share/initramfs-tools/hooks/ to create /etc/luks_header and to copy the header in. Then I changed /etc/crypttab by:

sda1_crypt UUID=xxx-xxx-xxx-xx none luks,header=/etc/luks_header/sda1-header-backup

So now I should boot with /sdb1. And the decryption is performed with LUKS header in /etc/luks_header/ (of initramfs).

Then to finish the deniability, I need to erase the LUKS header of sda1:

dd if=/dev/urandom of=/dev/sda1 bs=2M count=1

(The header's size is 2MB and begins at sector 0.) But when I'm trying to boot, the prompt tells me that he has a probleme with lvm.

I believe it is because I destroyed something after the header so I reduced my write with dd to 1MB but I have still the same problem. I thought I only touched the header (which should not be read thanks to crypttab), but I'm wrong. Can anyone explain me that?

The sites I found further information on:

• LUKS On-Disk Format Specification Version 1.1.1
• Plausible Deniability With LUKS

Answer 1

The UUID is on those 2MBs too.

You can't refer to the disk through an UUID that you overwritten with random bytes. You will need to refer to the disk by kernel name of the disk/partition. If need to change hardware an keep the references in /etc/crypttab and /etc/fstab resistant to that you may be able to get a better disk name, i.e. non-kernel boot procedure dependent like /dev/sdb, from /sys/devices/pci*.

Extra (information security relevant)

Note that Arno Wagner, the current maintainer of cryptsetup/LUKS argues against plausible deniability:

[encryption without LUKS] has limited value against the authorities. In civilized countries, they cannot force you to give up a crypto-key anyways. In quite a few countries around the world, they can force you to give up the keys (using imprisonment or worse to pressure you, sometimes without due process), and in the worst case, they only need a nebulous "suspicion" about the presence of encrypted data. Sometimes this applies to everybody, sometimes only when you are suspected of having "illicit data" (definition subject to change) and sometimes specifically when crossing a border. Note that this is going on in countries like the US and the UK, to different degrees and sometimes with courts restricting what the authorities can actually demand.

This is a quote from Arno's cryptsetup FAQ (sections 2.4 and 5.8)

But also note that plausible deniability is a highly debatable topic. For example see Is plausible deniability actually feasible for encrypted volumes/disks?