Skip to content

LUKS

dm-crypt and cryptsetup vs LUKS

dm-crypt and cryptsetup

  • Device-mapper is a part of the Linux kernel that provides a generic way to create virtual layers of block devices, most commonly LVM logical volumes.
  • The device-mapper crypt target (dm-crypt) provides transparent encryption of block devices using the kernel crypto API.
  • In Red Hat Enterprise, userspace interaction with dm-crypt is managed by a tool cryptsetup, which uses the device-mapper infrastructure to setup and operate on encrypted block devices.

LUKS

  • modern versions of cryptsetup (since ~2006) : encrypted block devices can be created in two formats, plain dm-crypt or extended LUKS (Linux Unified Key Setup-on-disk-format) .
  • LUKS provides a standard on-disk-format for hard disk encryption, which facilitates compatibility among Linux distributions and provides secure management of multiple user passwords
  • In contrast to previous Linux disk-encryption solutions, LUKS stores all necessary setup information in the partition header, enabling the user to more easily transport or migrate their data.
  • Advantages of LUKS over plain dm-crypt are higher usability: automatic configuration of non-default crypto parameters, the ability to add, change, and remove multiple passphrases.
  • Additionally, LUKS offers defenses against low-entropy passphrases like salting and iterated PBKDF2 passphrase hashing

info & examples

cat /proc/partitions  | grep -v 'loop'    # filter out the loop devices 
      =>    (blocks  *  bytes  = total in bytes )     (  140536832  blocks  183 GB 

blockdev --getsize64 /dev/sdb5   => 143909715968

blockdev --getsize64 /dev/sda   # returns size in bytes.
blockdev --getsz /dev/sda       # returns size in 512-byte sectors.
# Deprecated: `blockdev --getsize /dev/sda` returns size in sectors.

cryptsetup luksFormat /dev/sdb5