5 ms·
The LUKS headers doesn't contain the encryption keys, they're encrypted from the user's passphrase through a KDF. Additionally, you can make the LUKS header "de
by dev_hugepages 4y ago
The LUKS headers doesn't contain the encryption keys, they're encrypted from the user's passphrase through a KDF. Additionally, you can make the LUKS header "detached" (external) see https://wiki.archlinux.org/title/Dm-crypt/Specialties#Encrypted_system_using_a_detached_LUKS_header https://wiki.archlinux.org/title/Dm-crypt/Specialties#Encryp...
- josteink 4y agoBut my point was that if you want to backup such a volume (the encrypted LUKS volume), you will have to backup the whole volume, and can't do incremental backup. If you want to do incremental ZFS send/recieve backups, you have to do it on the unencrypted ZFS volume, and thus your backup wont be encrypted. That is you can't have both encrypted and incremental backups at the same time. With native ZFS encryption you do get that.