Would like a review of LUKSv2 workflow for external drive

Privacy Questions
1

Hi all,

I was looking for an alternative to Veracrypt for Full Disk Encryption (FDE), and learned about LUKS for external drives. I noticed that Gnome Disks allows for encrypting a partition with ext4 with LUKSv2. I wanted to know if there were any downsides from a security perspective for this. I did notice that using the command-line (cryptsetup), you can customize the hashing algorithm a bit, so I wanted to see if that was worth it. This is part of a broader workflow I am working on for new drives I purchase.

Extra context:

This is the current workflow I had envisioned:

  1. Smart Long Test - smartctl -t long /dev/drive
  2. Input output check - sudo fio --filename=/dev/sdxx --name=randwrite --ioengine=sync --iodepth=1 --rw=randrw --rwmixread=50 --rwmixwrite=50 --bs=4k --direct=0 --numjobs=8 --size=300G --runtime=7200 --group_reporting
  3. Use dd to random write to the whole drive - used for plausible deniability- sudo dd if=/dev/urandom of=/dev/sdb iflag=nocache oflag=direct bs=4096
  4. Use Gnome disks (without formatting the drive) to create partition and then apply luksv2 on it with ext4 as file system
  5. Backup Linux Header - cryptsetup luksHeaderBackup /dev/device --header-backup-file /mnt/backup/file.img
  6. (Maybe) Remove the Luks key so someone would have to work harder to brute-force it if the drive gets lost - cryptsetup luksRemoveKey ....
  7. (Maybe pt.2) After removing the header, use cryptsetup luksHeaderRestore /dev/drive --header-backup-file /path/to/backup_header_file to restore the full header back anytime I needed to access the contents on the drive.

I’m pretty new to this niche of Linux+privacy. I would love to hear your thoughts on any oversights on my part.

Thanks