LUKS: Difference between revisions

Revision as of 04:12, 26 July 2020

LUKS encryption

Getting Started

See Archwiki: dm-crypt/Device encryption.

Encrypting a device

Setup encryption

cryptsetup -v --type luks1 --cipher aes-xts-plain64 --key-size 512 --hash sha512 \
           --iter-time 3000 --use-urandom --verify-passphrase luksFormat <device>

Open encrypted drive

cryptsetup open <device> <name>

Create a partition

mkfs.fstype /dev/mapper/<name>
# E.g.
# mkfs.ext4 /dev/mapper/luksdrive1

Securely wipe the unused portion of the drive
- Do this to prevent cryptographic attacks and to overwrite existing data on the drive

dd if=/dev/zero of=<file_somewhere> status=progress
# Delete the file afterwards

Notes

You can see defaults using cryptsetup --help.
--type options
- luks defaults to luks1 on cryptsetup < 2.1.0, luks2 on cryptsetup >= 2.1.0
- luks1 is the standard version of LUKS.
- luks2 is a new version released in Dec 2017. Older versions of Grub (before 2.06 or June 2020) do not support booting from LUKS2.
- plain is dm-crypt plain mode. Avoid this unless you know what you're doing.
- loopaes Avoid this as well.
- tcrypt Use this for mounting older truecrypt volumes.

defaults

defaults on Ubuntu 18.04

Default compiled-in device cipher parameters:
	loop-AES: aes, Key 256 bits
	plain: aes-cbc-essiv:sha256, Key: 256 bits, Password hashing: ripemd160
	LUKS1: aes-xts-plain64, Key: 256 bits, LUKS header hashing: sha256, RNG: /dev/urandom

Mounting

# Open the encrypted drive
cryptsetup open <device> <name>
# Mount your partition
mount -t <fstype> /dev/mapper/<name> <mountlocation>

Unmounting

# Unmount your partition
umount <mountlocation>
# Close the decrypted drive
cryptsetup close <name>

Resources

nixCraft How To Linux Hard Disk Encryption With LUKS

@@ Line 7: / Line 7: @@
 * Setup encryption
 <pre>
-cryptsetup -v --type luks --cipher aes-xts-plain64 --key-size 512 --hash sha512 \
+cryptsetup -v --type luks1 --cipher aes-xts-plain64 --key-size 512 --hash sha512 \
             --iter-time 3000 --use-urandom --verify-passphrase luksFormat <device>
 </pre>
@@ Line 33: / Line 33: @@
 ;Notes
 * You can see defaults using <code>cryptsetup --help</code>.
-* <code>--type</code>
+* <code>--type</code> [https://wiki.archlinux.org/index.php/Dm-crypt/Device_encryption#Encryption_options_with_dm-crypt options]
-**
+** <code>luks</code> defaults to <code>luks1</code> on cryptsetup < 2.1.0, <code>luks2</code> on cryptsetup >= 2.1.0
+** <code>luks1</code> is the standard version of LUKS.
+** <code>luks2</code> is a new version released in Dec 2017. Older versions of Grub (before 2.06 or June 2020) do not support booting from LUKS2.
+** <code>plain</code> is dm-crypt plain mode. Avoid this unless you know what you're doing.
+** <code>loopaes</code> Avoid this as well.
+** <code>tcrypt</code> Use this for mounting older truecrypt volumes.
 {{ hidden | defaults |