1
$\begingroup$

So it's hard to make sense out of the title. Let me elaborate:

In LUKS, you can have multiple passwords that unlock the same volume (due to their "unified key setup" where they have a single master key). But I was wondering if you could have a single LUKS volume with, say, 2 passwords. The first password unlocks your secret data that you don't want your adversary to get. The second password unlocks pseudo-secret data (I.E. something like pornography, which would reasonably want to be hidden, but is not actually what you're trying to hide). This way, if your adversary found the 2nd password, then they'd think "Oh well this is embarrassing, but it's not what I'm looking for" and move on, being completely ignorant to the "shadow volume" of password #1 that really contains the secret data.

The only cryptographic protocol I've seen that exhibits this feature is steganography, specifically the program steghide. With steghide, you can splice secret data into a picture with one password, then also splice another, different piece of secret data into the same picture with a different password. Both pieces of data are accessible and not corrupted if you use the right passwords.

This is what I'm looking for. Is LUKS capable of doing this? If not, what is the closest thing that I could do to imitate this (aside from LUKS nuking, that's not what I'm looking for)?

$\endgroup$

1 Answer 1

3
$\begingroup$

No, LUKS does not support this. What you are looking for is plausible deniability, similar to what VeraCrypt supports. LUKS does not support this, with the reasoning explained in section 5.18 of the official cryptsetup FAQ. Their reasons for not supporting this boil down to the fact that it is difficult to use plausible deniability with hidden volumes correctly. For example, if you don't write to your dummy volume in a while and the timestamps show this, the deniability is broken.

$\endgroup$
1
  • 1
    $\begingroup$ Interesting. I didn't have a name for this concept, so I appreciate you giving me something to call it. I'll have to look into VeraCrypt, as I've never heard of it, and I'll keep your suggestions in mind. Thank you $\endgroup$ Commented Jun 19, 2018 at 4:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.