I have a disk containing (only) a LUKS encrypted volume. That was created on a bare drive with no partition table using cryptsetup v.1.6.1. When unlocked, I can check the size of the decrypted volume, compare it to the whole disk, and see that the difference is exactly 2MB. When I back up the header, on the other hand, using:
cryptsetup luksHeaderBackup /dev/sda --header-backup-file <filename>
I get a file that is 30kB less than 2MB. Using dd to dump the first 2MB of the disk and comparing it to the backed up header, I see that the 30KB is missing from the end and contains all 0's. Oddly, I have backups of various (other) LUKS headers using cryptsetup 1.4.1 and 1.4.3, and they are all exactly 2MB. This is consistent with section 6.2 of the cryptsetup FAQ, which says header size should be 2MB.
Could someone help me understand what this 30KB is? (I would like to overwrite the header with random data as I've put it on a separate device, and want to make sure I know what I'm doing.)
Also as a more general issue, is there an easier/automated way, using the output of luksDump perhaps, to tell exactly where the header is located on a disk? (Both offset and size.) I have read the cryptsetup FAQ, but the result certainly doesn't just drop out.
And, is there a better way to overwrite the header, than using dd?
cryptsetup luksHeaderRestore <file_with_random_data>
doesn't work, because cryptsetup does some idiot checks to see if any already present header matches in master key size and offset.