I would like to encrypt my external hard drive with dm-crypt+luks, but I am not satisfied with all the information, that the LUKS header is providing in plaintext.
So I would like to keep the LUKS header and the encrypted data separated from each other:
- Store the LUKS-Partition (CRYPT) without the header on the external drive.
- When ever I want to access the encrypted data, merge header and CRYPT and mount the luks partition normally.
I already know how I could manually achieve this:
- Backup LUKS header with dd.
- Overwrite LUKS header on external drive.
- Whenever the LUKS partition should be mounted, write it back and mount normally.
- Unmount and overwrite header again, when finished.
That is not very optimal, because the Sectors of the luks header would be overwritten every time the drive is mounted and I would fear, that those sectors will become bad for sure.
Another approach would be, that the header file and the encrypted luks partition are merged into one virtual linux device, that can be mounted normally.
With "merging into one virtual device" I mean, that the header is not actually written back to the luks partition, but the system is perceiving it that way. The header still remains on my usb-stick.
My only problem is, that I do not know how to create such a virtual device.
Any help would be appreciated.