View source for Block Device Encryption - dm-crypt

This document describes for Linux-based systems, how to encrypt a block device using LUKS/dm-Crypt/cryptsetup and automatically unlock and map the encrypted block device on boot.

== Requirements ==

* Linux-based Operating System (''Here: Ubuntu 20.04 LTS'')
* Plain dm-crypt and LUKS encrypted volumes manager installed (<code>apt install cryptsetup</code>) (''Here: v2.2.2'')
* Block device (''e.g. partition'') that is unmapped and ready to encrypt. (''Any content will be lost!'')

== TL;DR ==

<source lang="bash"># Encrypt block device
sudo cryptsetup luksFormat $BLOCK_DEVICE
# Generate a random keyfile
sudo dd if=/dev/urandom bs=256 count=1 of=$KEYFILE
# Add keyfile to the LUKS header key store
sudo cryptsetup luksAddKey $BLOCK_DEVICE $KEYFILE
# Unlock and map the encrypted device on boot via UUID (See: man crypttab)
UUID=`sudo cryptsetup luksUUID $BLOCK_DEVICE`
echo "$MAPPER_NAME UUID=$UUID $KEYFILE" | sudo tee -a /etc/crypttab
# Dump the header information of a LUKS device.
sudo cryptsetup luksDump $BLOCK_DEVICE

# USE IT.
man cryptsetup
</source>

== Encryption ==

Initializes a LUKS partition and sets the initial passphrase (''for key-slot 0''). LUKS2 is used by default. All available algorithms (''cipher, hash'') are listed in <code>/proc/crypto</code> or use <code>cryptsetup benchmark</code>.

<source lang="bash"># CHANGE THIS VARIABLE TO THE APPROPRIATE BLOCK DEVICE
BLOCK_DEVICE="/dev/sdb1"

# Encrypt block device (Here: using defaults)
sudo cryptsetup luksFormat $BLOCK_DEVICE

# Verify: Dump the header information
sudo cryptsetup luksDump $BLOCK_DEVICE
# Verify: Inspect device content
sudo hexdump -C $BLOCK_DEVICE | less
</source>
'''Additional <code>luksFormat</code> parameters''':

<code>--cypher</code>: (Default: '''aes-xts-plain64''')<br />
<code>--key-size</code>: (Default: '''256''')<br />
<code>--hash</code>: Algorithm used to derive the key. (Default: '''sha256''')<br />
<code>--time</code>: The time used for passphrase processing. (Default: '''2000''') milliseconds.<br />
<code>--use-random/--use-urandom</code>: Used RNG. (Default: '''--use-urandom''')

== Auto-Mount during Boot ==

In the following a keyfile will be added to the LUKS header key store to use with <code>crypttab</code> for automatic device unlocking and mapping at boot. The resulting mapped device can be added a filesystem via <code>mkfs</code> and automatically mounted using <code>fstab</code>.

<source lang="bash"># CHANGE THIS VARIABLE TO A SAFE LOCATION TO STORE THE KEYFILE
KEYFILE="/root/key.bin"
# CHANGE THIS VARIABLE TO THE NAME OF THE DEVICE MAPPER MOUNTPOINT
MAPPER_NAME="enc_dev"

# Generate a random Keyfil and limit access
sudo dd if=/dev/urandom bs=32 count=1 of=$KEYFILE
sudo chmod 400 $KEYFILE

# Add keyfile to the LUKS key storage (max. 8)
sudo cryptsetup luksAddKey $BLOCK_DEVICE $KEYFILE
# Remove: sudo cryptsetup luksRemoveKey $BLOCK_DEVICE
# The passphrase (aka. key-slot 0) remains as backup key

# The crypttab file describes encrypted block devices that are set up during system boot.
# Format: volume-name encrypted-device key-file options
UUID=`sudo cryptsetup luksUUID $BLOCK_DEVICE`
echo "$MAPPER_NAME UUID=$UUID $KEYFILE" | sudo tee -a /etc/crypttab

# Reboot. Then Verify.
lsblk "/dev/mapper/$MAPPER_NAME"
</source>
== References ==

* https://gitlab.com/cryptsetup/cryptsetup/
* https://wiki.archlinux.org/index.php/Dm-crypt/Drive_preparation
* https://wiki.archlinux.org/index.php/Dm-crypt/Device_encryption
* https://wiki.archlinux.org/index.php/Dm-crypt/System_configuration#crypttab

[[Category:Documentation]]
[[Category:Basics]]