Leo: Added categories

2020-06-14T23:46:00Z

Added categories

← Older revision		Revision as of 23:46, 14 June 2020
Line 85:		Line 85:
	== See Also ==		== See Also ==
	* https://wiki.archlinux.org/index.php/Dm-crypt/Device_encryption		* https://wiki.archlinux.org/index.php/Dm-crypt/Device_encryption

			{{Navbox Linux}}[[Category:Linux]]
			[[Category:LinuxUtilities]]

Leo: /* Keys */

2019-09-16T18:54:40Z

Keys

← Older revision		Revision as of 18:54, 16 September 2019
Line 61:		Line 61:

	==== Keys ====		==== Keys ====
			There are in total of 8 key slots that can be use. The first key slot is used by the passphrase in the initial creation step.

	To change your passphrase:		To change your passphrase:
Line 81:		Line 82:
	# cryptsetup luksDump /dev/sdX		# cryptsetup luksDump /dev/sdX
	}}		}}


	== See Also ==		== See Also ==
	* https://wiki.archlinux.org/index.php/Dm-crypt/Device_encryption		* https://wiki.archlinux.org/index.php/Dm-crypt/Device_encryption

Leo: Created page with "dm-crypt is a transparent disk encryption subsystem. dm-crypt maps a physical block device to a virtual block device and does encryption/decryption transparently between the t..."

2019-09-16T18:25:58Z

Created page with "dm-crypt is a transparent disk encryption subsystem. dm-crypt maps a physical block device to a virtual block device and does encryption/decryption transparently between the t..."

New page

dm-crypt is a transparent disk encryption subsystem. dm-crypt maps a physical block device to a virtual block device and does encryption/decryption transparently between the two block devices.

== Modes ==
There are two common modes when using dm-crypt: Plain-mode and with LUKS.

Plain mode encrypts sector by sector without any headers or metadata. The entire volume contains just the raw encrypted cyphertext and nothing else. LUKS on the other hand has a standardized format facilitating compatibility across different distributions in addition to supporting multi-user passwords.

Disadvantages with plain mode:
* dm-crypt won't know whether your password is correct or not.
* dm-crypt won't know what encryption settings were used and any changes to this from software upgrades will break
* passphrase cannot be changed without re-encrypting the volume

Advantages with using LUKS:
* passphrase is used to decrypt a master key stored in the header and therefore can be changed without re-encrypting a volume
* passphrase can be keystretched to strengthen against brute-forcee attacks
* encryption settings are saved unencrypted in a header making it compatible with different systems

An attacker can easily recognize the type of volume by inspecting the unencrypted header.

== Usage ==
On a Red Hat based system, install the {{code|cryptsetup}} package.

=== Plain Mode ===
{{highlight|lang=terminal|code=
# cryptsetup --verify-passphrase open --type plain /dev/sdX sdX-plain
## Use /dev/mapper/sdX-plain as any other block device
# cryptsetup close sdX-plain
}}

=== LUKS ===
Basic usage:
{{highlight|lang=terminal|code=
# cryptsetup luksFormat /dev/sdX
# cryptsetup luksOpen /dev/sdX sdX-luks
## Use /dev/mapper/sdX-luks
# cryptsetup luksClose sdX-luks
}}

The LUKS header can be backed up and restored:
{{highlight|lang=terminal|code=
# cryptsetup luksHeaderBackup /dev/sdX --header-backup-file sdX-luks-header
# cryptsetup luksHeaderRestore /dev/sdX --header-backup-file sdX-luks-header
}}

==== Options ====
There are some options that can be passed to {{code|cryptsetup}}:
{| class="wikitable"
! Option !! Defaults !! Description
|-
| {{code|--hash}}, {{code|-h}} || sha256 || Hash algorithm used for key derivation. Eg: sha256, sha512, ripemd160
|-
| {{code|--cipher}}, {{code|-c}} || aes-xts-plain64 || Cipher to use for encryption. Eg: aes-xts-plain64, aes-cbc-essiv:sha256
|-
| {{code|--key-size}}, {{code|-s}} || 256 (512 for XTS) || Key size used for encryption
|-
| {{code|--verify-passphrase}}, {{code|-y}} || yes || Verify passphrase for sanity check
|}

When using luksFormat or luksAddKey, you may want to specify {{code|--iter-time}} or {{code|-i}} to specify the number of milliseconds to spend with PBKDF2.

==== Keys ====

To change your passphrase:
{{highlight|lang=terminal|code=
# cryptsetup luksChangeKey /dev/sdX
}}

To set up an additional passphrase that can unlock the container.
{{highlight|lang=terminal|code=
# cryptsetup luksAddKey /dev/sdX
}}

To remove a passphrase from a key slot:
{{highlight|lang=terminal|code=
# cryptsetup luksRemoveKey /dev/sdX
}}

To see which key slots are in use:
{{highlight|lang=terminal|code=
# cryptsetup luksDump /dev/sdX
}}

== See Also ==
* https://wiki.archlinux.org/index.php/Dm-crypt/Device_encryption

Dm-crypt - Revision history

Leo: Added categories

Leo: /* Keys */

Leo: Created page with "dm-crypt is a transparent disk encryption subsystem. dm-crypt maps a physical block device to a virtual block device and does encryption/decryption transparently between the t..."