Shufflecake is a tool for Linux that allows the creation of multiple hidden volumes on a storage device in such a way that it is very difficult, even under forensic inspection, to prove the existence of such volumes.
Security auditing firm Kudelski Security has released the Shufflecake toolset , which allows the creation of hidden file systems distributed across available free space on existing partitions, indistinguishable from random residual data. These sections are created in such a way that, without knowing the access key, proving their existence is problematic, even during forensic analysis.
The project positions itself as a more advanced solution than Truecrypt and Veracrypt for hiding confidential data, offering native support for the Linux platform and allowing you to place up to 15 hidden partitions on the device, nested within each other to obfuscate the analysis of their existence.
The hidden partitions created , at the user's discretion, can be formatted to suit any file system, for example, ext4, xfs, or btrfs. Each partition is treated as an independent virtual block device with its own unlock key.
To obfuscate traces, the "plausible deniability" behavioral model is proposed. Essentially, valuable data is hidden as additional layers within encrypted sections containing less valuable data, forming a kind of hidden hierarchy of sections. Under pressure, the device owner can reveal the key to the encrypted section, but other sections (up to 15 nested levels) can be hidden within it, making it difficult to determine their presence and prove their existence.
Shufflecake and the kernel module have only been tested on Debian and Ubuntu with kernels 5.13 and 5.15 (Ubuntu 22.04 is supported). It should be noted that the project should still be considered a working prototype and should not be used to store sensitive data.
In the future, we plan to make additional optimizations for performance, reliability, and security, as well as provide the ability to boot from Shufflecake partitions.
About Shufflecake
Concealment is achieved by forming each partition as a set of encrypted segments placed in random positions on the storage device. Each segment is created dynamically when the partition requires additional storage space. To complicate analysis, slices from different sections are interleaved.
Shufflecake sections are not linked to contiguous regions, and portions from all sections are mixed together. Information about the used and free portions is stored in the location map attached to each section, which is referenced by the encrypted header. The cards and header are encrypted and, without knowing the passkey, are indistinguishable from random data.
The header is divided into slots , each of which defines its own section and associated sectors. The slots in the header are stacked and recursively linked: the current slot contains the key to decrypt the parameters of the previous (less hidden) section in the hierarchy, allowing a single password to decrypt all the less hidden sections associated with the selected item. Each less hidden section treats portions of nested sections as free.
By default, all nested Shufflecake partitions have the same visible size as the top-level partition. For example, if three partitions are used on a 1GB device, each will be visible to the system as a 1GB partition, and the total available disk space will be shared among all partitions. If the total amount of data stored exceeds the actual device size, I/O errors will begin to occur.
Unopened nested sections do not participate in space allocation; that is, attempting to fill a higher-level section will overwrite the data in the nested sections, but will not reveal their presence through analysis of the size of the data that can be placed in the section before an error is generated (it is assumed that the higher-level sections contain immutable data). Data is not used by chance and never separately, and regular work is always carried out with the most recent nested section; the schema itself implies that the main thing is to keep the existence of data a secret, even at the cost of losing the data.
The Shufflecake implementation offers relatively high performance, but due to overhead costs, it performs about half as well as disk encryption based on the LUKS subsystem. Using Shufflecake also incurs additional RAM and disk space costs for storing service data. Memory costs are estimated at 60 MB per partition , and disk space usage is estimated at 1% of the total partition size. By comparison, the similarly purposeful WORAM technique results in a 5- to 200-fold slowdown with a 75% loss of usable disk space.
The code for the utilities (shufflecake-userland) and the Linux kernel module (dm-sflc) is written in C and released under the GPLv3 license, which makes it impossible to include the published kernel module in the main Linux kernel. due to incompatibility under the GPLv2 license under which the kernel is shipped.
If you are interested in learning more, you can find the details at the following link.