Plausible deniability on an encrypted external drive?

Question

Hello,
I would like to use an external drive as a backup to store my personal data. As I don't care about Windows compatibility, LUKS seems good for that.
But my problem is to encrypt my critical data (like bank details), where a nested hidden volume seems a good option. Arch still has the "good" version of TrueCrypt, but its strange end of life announcement make me wonder if it's still good to use.
LUKS' author doesn't plan to add this yet, listing a number of reasons but a comment (#18) seems to tell it's feasable.
So what are my options if I want to do that?
Thanks.

Answer 1

In regards to plausible deniability, it's possible to go even further if you're willing to roll up your sleeves...
You can do something like creating a "normal" partition containing stuff you don't care too much about, partially spanning the disk. Then, in the unallocated space beyond that partition, pick a region of sectors to use as the encrypted volume, and set up a loop device to access them.
losetup -o [offset in bytes] --sizelimit [size in bytes] /dev/loop0 /dev/sdX
Then, set up dm-crypt in *plain* mode on that loop device (plain mode means no header, so the encrypted data is theoretically indistinguishable from random garbage):
cryptsetup --cipher=${chosen_cipher} open --type=plain /dev/loop0 ${some_name}
which will make the decrypted device show up at /dev/mapper/some_name. This command prompts for a passphrase to be entered. note this command has do be re-done the same each time you need to mount the decrypted storage. You can also use a keyfile, by adding
--key-file=somefile --key-size=${size_of_key_in_bits}
to the cryptsetup command before "open". The mapper device can then be closed with
crypsetup close ${some_name}
and the raw loop device removed with
losetup -d /dev/loop0
If you do it this way, both the opening commands must be done manually when you want to access the encrypted storage. Additionally you'll need to remember the offset and size of the region on the external drive that is your encrypted data. However, if you overwrite the disk with random data before starting, there's no way to tell the encrypted data is there just by looking at the disk - hidden amongst the random data. The idea of the normal partition before it is to act like a decoy, so you could claim the "unallocated" space is just where you want to add a new partition later.