LUKS: Difference between revisions
| (7 intermediate revisions by the same user not shown) | |||
| Line 16: | Line 16: | ||
# Setup encryption | # Setup encryption | ||
cryptsetup | cryptsetup --type luks2 -v luksFormat "${DEVICE}" | ||
# Open encrypted drive to /dev/mapper/$NAME | # Open encrypted drive to /dev/mapper/$NAME | ||
| Line 24: | Line 23: | ||
# Create a partition | # Create a partition | ||
mkfs.btrfs /dev/mapper/${NAME} | mkfs.btrfs /dev/mapper/${NAME} | ||
# Create a mountpoint and mount | |||
mkdir -p /media/${NAME} | |||
mount -t btrfs /dev/mapper/${NAME} /media/${NAME} | mount -t btrfs /dev/mapper/${NAME} /media/${NAME} | ||
| Line 39: | Line 41: | ||
===Unmounting=== | ===Unmounting=== | ||
< | <syntaxhighlight lang="bash"> | ||
# Unmount your partition | # Unmount your partition | ||
umount "${MOUNT_LOCATION}" | umount "${MOUNT_LOCATION}" | ||
# Close the decrypted drive | # Close the decrypted drive | ||
cryptsetup close ${NAME} | cryptsetup close ${NAME} | ||
</ | </syntaxhighlight> | ||
===Encrpytion Options=== | ===Encrpytion Options=== | ||
| Line 51: | Line 53: | ||
* <code>--type</code> [https://wiki.archlinux.org/index.php/Dm-crypt/Device_encryption#Encryption_options_with_dm-crypt options] | * <code>--type</code> [https://wiki.archlinux.org/index.php/Dm-crypt/Device_encryption#Encryption_options_with_dm-crypt options] | ||
** <code>luks</code> defaults to <code>luks1</code> on cryptsetup < 2.1.0, <code>luks2</code> on cryptsetup >= 2.1.0 | ** <code>luks</code> defaults to <code>luks1</code> on cryptsetup < 2.1.0, <code>luks2</code> on cryptsetup >= 2.1.0 | ||
** <code>luks1</code> is the | ** <code>luks1</code> is the old version of LUKS. | ||
** <code>luks2</code> is | ** <code>luks2</code> is the current version released in Dec 2017. Older versions of Grub (before 2.06 or June 2020) do not support booting from LUKS2. | ||
** <code>plain</code> is dm-crypt plain mode. Avoid this unless you know what you're doing. | ** <code>plain</code> is dm-crypt plain mode. Avoid this unless you know what you're doing. | ||
** <code>loopaes</code> Avoid this as well. | ** <code>loopaes</code> Avoid this as well. | ||
| Line 74: | Line 76: | ||
</pre> | </pre> | ||
{{ hidden | Example Output | | {{ hidden | Example Output (i7-12700K) | | ||
<pre> | <pre> | ||
# Tests are approximate using memory only (no storage IO). | # Tests are approximate using memory only (no storage IO). | ||
PBKDF2-sha1 | PBKDF2-sha1 3057072 iterations per second for 256-bit key | ||
PBKDF2-sha256 | PBKDF2-sha256 6452775 iterations per second for 256-bit key | ||
PBKDF2-sha512 | PBKDF2-sha512 2432890 iterations per second for 256-bit key | ||
PBKDF2-ripemd160 | PBKDF2-ripemd160 1289761 iterations per second for 256-bit key | ||
PBKDF2-whirlpool | PBKDF2-whirlpool 1148495 iterations per second for 256-bit key | ||
argon2i | argon2i 13 iterations, 1048576 memory, 4 parallel threads (CPUs) for 256-bit key (requested 2000 ms time) | ||
argon2id | argon2id 13 iterations, 1048576 memory, 4 parallel threads (CPUs) for 256-bit key (requested 2000 ms time) | ||
# Algorithm | Key | Encryption | Decryption | # Algorithm | Key | Encryption | Decryption | ||
aes-cbc 128b | aes-cbc 128b 1976.6 MiB/s 7781.1 MiB/s | ||
serpent-cbc 128b | serpent-cbc 128b 136.8 MiB/s 993.0 MiB/s | ||
twofish-cbc 128b | twofish-cbc 128b 291.3 MiB/s 646.8 MiB/s | ||
aes-cbc 256b | aes-cbc 256b 1507.6 MiB/s 6406.3 MiB/s | ||
serpent-cbc 256b | serpent-cbc 256b 138.2 MiB/s 984.0 MiB/s | ||
twofish-cbc 256b | twofish-cbc 256b 295.3 MiB/s 647.1 MiB/s | ||
aes-xts 256b | aes-xts 256b 6021.9 MiB/s 5909.9 MiB/s | ||
serpent-xts 256b | serpent-xts 256b 855.7 MiB/s 887.4 MiB/s | ||
twofish-xts 256b | twofish-xts 256b 597.8 MiB/s 608.0 MiB/s | ||
aes-xts 512b | aes-xts 512b 5521.2 MiB/s 5505.7 MiB/s | ||
serpent-xts 512b | serpent-xts 512b 870.2 MiB/s 897.9 MiB/s | ||
twofish-xts 512b | twofish-xts 512b 602.9 MiB/s 607.1 MiB/s | ||
</pre> | </pre> | ||
}} | }} | ||
| Line 114: | Line 116: | ||
;Benchmark<ref>[https://www.reddit.com/r/crypto/comments/b3we04/aesadiantum_new_mode_in_linux_kernel_5/ https://www.reddit.com/r/crypto/comments/b3we04/aesadiantum_new_mode_in_linux_kernel_5/]</ref> | ;Benchmark<ref>[https://www.reddit.com/r/crypto/comments/b3we04/aesadiantum_new_mode_in_linux_kernel_5/ https://www.reddit.com/r/crypto/comments/b3we04/aesadiantum_new_mode_in_linux_kernel_5/]</ref> | ||
<pre> | <pre> | ||
cryptsetup benchmark -c xchacha12,aes-adiantum | cryptsetup benchmark -c xchacha12,aes-adiantum | ||
</pre> | </pre> | ||