Skip to main content

Linux Unified Key Setup (LUKS)

Prepare Disks

Before encrypting a drive, it is recommended to perform a secure erase of the disk by overwriting the entire drive with random data. To prevent cryptographic attacks or unwanted file recovery, this data is ideally indistinguishable from data later written by dm-crypt.

Source

Partition

Although LUKS can be layered on top of redundant storage (btrfs/mdadm+dm-integrity) for my usages it almost always makes sense to layer those things on top of LUKS.