Wipe luks partition in pre-boot

Question

I have a machine running CentOS7 whose primary partition is encrypted via crypt-setup / luks; I am prompted for my encryption password on boot.

This is a machine that is to be turned over to another party - my question is

Without the need for a bootable USB, how can I scramble the encrypted partition?

I had hoped / assumed that failing the encryption password a bunch of times would invoke a scramble, but it only appears as if it stops accepting passwords until a reboot.

Answer 1

This is simple to do:

sudo cryptsetup luksErase /dev/sdXY

Replace /dev/sdXY with the encrypted partition.

You'll receive a prompt that looks like this:

deltik@node51 [~]$ sudo cryptsetup luksErase /dev/sda1

WARNING!
========
This operation will erase all keyslots on device /dev/sda1.
Device will become unusable after this operation.

Are you sure? (Type uppercase yes):

Type "YES" and press Enter. Your computer will keep running, but once you reboot, you will never be able to access the data again.

---

You can accomplish the same goal in another way without getting prompted by running this command:

sudo dd if=/dev/zero of=/dev/sdXY bs=1M count=2

It'll overwrite the first two megabytes of the partition /dev/sdXY, which should cover the entire LUKS encryption header.

Answer 2

To wipe anything (disk, partition, file) this is a good command to start:

dd if=/dev/random of=<TheFullPath> bs=1M

Run it from any LiveCD in console, but be sure what you are doing, specialy ensure the path is the correct one.

But if you want data to not be recoverable you need more complex techniques, more if the disk use internal re-map to enlarge its live and you try to wipe a file, not a full partition or disk.

Also worst, in laboratories the disks can be scanned and can obtain a lot of last states of what was there, for magnetic the record is arround last 500 states, for solid state disk is arround 100 last states.

So to be sure you really 'destroy' the 'data', you must do the wipe at least more than 500 times on magnetic media or more than 100 times on solid state media. Warning: Doing that shorts the live a lot.

So, if you have never ever had the data on plain (not encrypted) you may think you are safe not doing so many wipes, you are wrong, the not encrypted data will not be readed, but encrypted data will be possible to be getted, also the LUKs headers you has wiped, so it is only time and effort to break that encryption.

So, you may think, well if i do >500 wipes only on LUKs header i will be on the safe line, wrong again, the encrypted data is still recoverable and testing with all possible LUKs headers (a lot of work) can test each as on previous paragraph, again it is only a matter of time.

To 100% ensure data will not be exposed, you must think this way:

• Attacker has infinite computation power and infinite money

So the only way of doing things like '100% secure' wipe is only:

• Convert the whole disk into GAS, so no way to recover any data

There is no other way to be 100% secure, no matter what any other say, if disk is not volatilized, data will be recoverable in the future.

Just think, some years ago the record of last states was only less than ten, now has increased a lot 100 on solid state, 500 on magnetic; what level will be in let's say a million years!

If you only need to re-use the disk (you are not selling the disk) you must not worry so much, just do one wipe to LUKs headers.

Extra: On most modern disks (since ten years or so) they have a 'reserved' area that they use when one sector of the disk is not working correctly (normally that situation is shown in S.M.A.R.T data); when that happens it can occur that such sector is still readable but not writeable, so wipe that one is not possible.

My best action of rules are, when i want to use a disk for 'secured' data:

1. Buy a new one (first hand or second hand)
2. Short a lot its live by doing a one thousand wipes
3. Encrypt it (still does not have any data) and fill it with garbage, so garbage gets encrypted
4. Mark it with a sticker 'secured'
5. Delete that garbage and use it
6. When i want to not use it (after some time that i consider it can fail after two thousand wipes) i get rid of it by doing some steps
7. Clone all onto another 'secured' one that i create by this steps
8. Short a lot its live to end by doing a infinite wipes till fail
9. Go back to step 1 so the new one will be used as destiny for next step 7

It is somehow a little paranoid, but you asked to Wipe something.

Now about the other part, only wipe LUKS headers, as you can imagine and as i told you, it is not enough to avoid others (with infinite time, money and resources) to get such data if you let them put theirs hands on it. better wipe all if you are going to not have anymore that disk.

About the final part, doing it on pre-boot time, i do not know any tool that can be run on that stage and do such wipe and i think it would not be anyone because:

• Pre-Boot code runs in 16 bit mode and also can jump to 32 bits mode, but not to 64 / 128 bit modes (actually there are very little 128bit processors, most are only prototypes), so it runs a lot of times slower and since you need to do random maths or patterns, CPU is highly used

Other thing is boot from a small Linux distro, or an old MS-DOS, for them there are tools that can wipe, Linux dd is slow but enough.

And just in case, your question has a not so good title, i am thinking you may be really asking:

• How can i have a running Linux on a LUKs that will be impossible to mount such LUKs again?

For such, there are two solutions:

• You want to be able to mount that LUKs again, but only you and no one else: Do not store LUKs headers on such disk, store them on external media you carry on your pocket
• You want no one be able to mount that LUKs again including yourself: Do a LUKs delete (if Linux allow it for a running system, i doubt it) or Wipe with dd the Linux headers

Hope i could help you and others with that 'security' questions.

Note: I do not understand why people is not teached by real experts about security (i learn all i know, the worst hard way!), and why it is not teached on primary school?.

P.D.: In some very specialized shops there are disks with hardware encryption that has explosives inside that literally blow up the disk in the case of N consecutive fails and in case the disk is opened, readed at low level, etc., not cheap, really expensive and you need an autorithation to carry them, on flights they must go on a special container, etc. I used one of them some time ago, but learn the hard way what such explosives means... computer was totally destoryed and the table where i had it gots a great hole, so beware what you buy and how you use it (not let family to even touch it, etc.), for personal use is too risky.