LUKS: Difference between revisions

From David's Wiki
No edit summary
Line 30: Line 30:
</pre>
</pre>


===Mounting===
<pre>
# Open the encrypted drive
cryptsetup open <device> <name>
# Mount your partition
mount -t <fstype> /dev/mapper/<name> <mountlocation>
</pre>
===Unmounting===
<pre>
# Unmount your partition
umount <mountlocation>
# Close the decrypted drive
cryptsetup close <name>
</pre>
===Encrpytion Options===


;Notes
* You can see defaults using <code>cryptsetup --help</code>.
* You can see defaults using <code>cryptsetup --help</code>.
* <code>--type</code> [https://wiki.archlinux.org/index.php/Dm-crypt/Device_encryption#Encryption_options_with_dm-crypt options]
* <code>--type</code> [https://wiki.archlinux.org/index.php/Dm-crypt/Device_encryption#Encryption_options_with_dm-crypt options]
Line 40: Line 56:
** <code>loopaes</code> Avoid this as well.
** <code>loopaes</code> Avoid this as well.
** <code>tcrypt</code> Use this for mounting older truecrypt volumes.
** <code>tcrypt</code> Use this for mounting older truecrypt volumes.
* <code>--iter-time</code> dynamically determines the number of iterations used to hash your password. The number of iterations is determined when creating the luks key. E.g. <code>5000</code> means hash for 5 seconds and use that many iterations. You can see the number of iterations for each key with <code>cryptsetup luksDump &lt;device&gt;</code>.


{{ hidden | defaults |
{{ hidden | defaults |
Line 50: Line 68:
</pre>
</pre>
}}
}}
===Mounting===
<pre>
# Open the encrypted drive
cryptsetup open <device> <name>
# Mount your partition
mount -t <fstype> /dev/mapper/<name> <mountlocation>
</pre>
===Unmounting===
<pre>
# Unmount your partition
umount <mountlocation>
# Close the decrypted drive
cryptsetup close <name>
</pre>


==Benchmark==
==Benchmark==

Revision as of 05:17, 3 August 2020

LUKS encryption

Getting Started

See Archwiki: dm-crypt/Device encryption.

Encrypting a device

  • Setup encryption
cryptsetup -v --type luks1 --cipher aes-xts-plain64 --key-size 512 --hash sha512 \
           --iter-time 5000 --use-urandom --verify-passphrase luksFormat <device>
  • Open encrypted drive
cryptsetup open <device> <name>
  • Create a partition
mkfs.fstype /dev/mapper/<name>
# E.g.
# mkfs.ext4 /dev/mapper/luksdrive1
  • Securely wipe the unused portion of the drive
    • Do this to prevent cryptographic attacks and to overwrite existing data on the drive
dd if=/dev/zero of=<file_somewhere> status=progress
# Delete the file afterwards

Mounting

# Open the encrypted drive
cryptsetup open <device> <name>
# Mount your partition
mount -t <fstype> /dev/mapper/<name> <mountlocation>

Unmounting

# Unmount your partition
umount <mountlocation>
# Close the decrypted drive
cryptsetup close <name>

Encrpytion Options

  • You can see defaults using cryptsetup --help.
  • --type options
    • luks defaults to luks1 on cryptsetup < 2.1.0, luks2 on cryptsetup >= 2.1.0
    • luks1 is the standard version of LUKS.
    • luks2 is a new version released in Dec 2017. Older versions of Grub (before 2.06 or June 2020) do not support booting from LUKS2.
    • plain is dm-crypt plain mode. Avoid this unless you know what you're doing.
    • loopaes Avoid this as well.
    • tcrypt Use this for mounting older truecrypt volumes.
  • --iter-time dynamically determines the number of iterations used to hash your password. The number of iterations is determined when creating the luks key. E.g. 5000 means hash for 5 seconds and use that many iterations. You can see the number of iterations for each key with cryptsetup luksDump <device>.
defaults

Benchmark

cryptsetup benchmark
Example Output

Adiantum

If you're running a device which does not support AES instructions (e.g. Raspberry Pi), you may be interested in Adiantum[1].
Adiantum is an encryption mode by Google which uses ChaCha12 for block encryption. It is included in Linux kernel v5.0.

Creation
cryptsetup -v --type luks2 --cipher xchacha12,aes-adiantum --sector-size 4096 \
           --key-size 256 --hash sha512 --iter-time 5000 --use-urandom \
           --verify-passphrase luksFormat <device>
Benchmark[2]
cryptsetup benchmark -c xchacha12,aes-adiantum -s 512

Scripts

mount_drives.sh
unmount_drives.sh

Resources

References