# Can wiping a disk writing zeros on an encrypted device be a weak point?

Can cryptsetup suggestion of wiping a disk before encryption with zeros written to an encryted device as described in question 2.19 as the recommended method on the CryptsetupFAQ (the part that starts with "For device set-up, do the following:" (which ends writing the encrypted random looking represantation of zeros) be a weak point as an attacker, knowing that the device is encrypted with LUKS, could suppose that the end of the disk is just zeros. With this information could he more easily find the key used on the initial wipping and, with this info, isolate the part of the disk that actually has relevant encrypted information?

• It doesn't suggest to wipe as 0. The conventional recommendation if you want to not just do a zero-wipe is to use something like Dec 9 '18 at 22:48
• I still don't see the encryption of zero. It takes input from /dev/urandom Dec 9 '18 at 22:59
• At the first paragraph of 2.19, they say "the conventional recommendation" is to use /dev/urandom but on the third paragraph they say "For device set-up, do the following:" cat /dev/zero > /dev/mapper/to_be_wiped Dec 9 '18 at 23:03
• @Rsevero The fundamental issue you bring up is that what you believe to be zero is not zero on the media. If you have an encrypted volume, it has a master key that will be used to encrypt the stream onto the media. Therefore, cat /dev/zero > /dev/mapper/to_be_wiped is actually not placing a bitstream of zero onto the media. Depending on the block mode, and other settings, you could get enough information for tell where the volume started, stopped, and possibly the key. I think that the documentation is also fragmented. Dec 10 '18 at 1:33
• @bdegnan There is no block mode where that would give away the key. Dec 10 '18 at 9:15

What you do is not write zeros to the block device for the drive, but for the encrypted mapping. That is, instead of writing zeros to /dev/sdx, you write to /dev/mapper/sdx_crypt. This results in the contents on the actual drive being completely randomized. Even though an attacker may know that zeros were encrypted, they would be no closer to finding the key than before. If they were, it would mean the underlying cipher is vulnerable to a known plaintext attack, and none of the supported LUKS ciphers (AES, Twofish, Serpent, etc.) are. In fact, any symmetric cipher that was badly vulnerable to a known plaintext attack would be considered fatally broken, and would be either revised or discarded.