LUKS/Advanced - Revision history

CRYSTL: /* Benchmarking */

2026-07-01T01:29:19Z

Benchmarking

← Older revision		Revision as of 01:29, 1 July 2026
Line 49:		Line 49:
	<code>argon2i 4 iterations, 735656 memory, 4 parallel threads (CPUs) for 256-bit key (requested 2000 ms time)</code>		<code>argon2i 4 iterations, 735656 memory, 4 parallel threads (CPUs) for 256-bit key (requested 2000 ms time)</code>
	<code>argon2id 4 iterations, 842046 memory, 4 parallel threads (CPUs) for 256-bit key (requested 2000 ms time)</code>		<code>argon2id 4 iterations, 842046 memory, 4 parallel threads (CPUs) for 256-bit key (requested 2000 ms time)</code>
	<code> Algorithm \| Key \| Encryption \| Decryption</code>~~[[entropy]]~~		<code> Algorithm \| Key \| Encryption \| Decryption</code>
	<code> aes-cbc 128b 594.1 MiB/s 1434.3 MiB/s</code>		<code> aes-cbc 128b 594.1 MiB/s 1434.3 MiB/s</code>
	<code> serpent-cbc 128b 59.8 MiB/s 371.1 MiB/s</code>		<code> serpent-cbc 128b 59.8 MiB/s 371.1 MiB/s</code>

CRYSTL: move Disk Setup to intermediate

2026-07-01T01:25:37Z

move Disk Setup to intermediate

← Older revision		Revision as of 01:25, 1 July 2026
Line 70:		Line 70:

	An easy way to ensure you have enough entropy, is to gather it from an external source. For example, you can run: <code>curl -Ss <nowiki>https://www.random.org/cgi-bin/randbyte?nbytes=16384&format=f</nowiki> > /dev/random</code>. This command gathers random bytes from [https://random.org random.org]. Using an external source like this is ok, since Linux has ways to gather entropy besides this that an attacker would not be able to replicate.		An easy way to ensure you have enough entropy, is to gather it from an external source. For example, you can run: <code>curl -Ss <nowiki>https://www.random.org/cgi-bin/randbyte?nbytes=16384&format=f</nowiki> > /dev/random</code>. This command gathers random bytes from [https://random.org random.org]. Using an external source like this is ok, since Linux has ways to gather entropy besides this that an attacker would not be able to replicate.

	~~== Disk Setup ==~~
	~~Assuming you know what partition you want to use, setting up the disk is as simple as:~~

	~~<code>cryptsetup luksFormat --type luks2 --cipher aes-xts-plain64 --hash sha256 --iter-time 2000 --key-size 256 --pbkdf argon2id --use-random --verify-passphrase /dev/YOURPARTITIONHERE</code>~~

	As mentioned previously, these settings are the default on the latest cryptsetup (with the exception of <code>--use-random</code>). Setting them manually ensures that they are correct on older versions. You can check what the defaults are for your system by running <code>cryptsetup --help</code>. You can then verify that it was setup correctly with:

	~~<code>cryptsetup luksDump /dev/YOURPARTITIONHERE</code>~~

	~~Once it has been setup, it can be opened with:~~

	~~<code>cryptsetup open /dev/YOURPARTITIONHERE dm_name</code>~~

	~~Note that "dm_name" can be set to whatever you like, and the disk will be available at:~~

	~~<code>/dev/mapper/dm_name</code>~~

	~~Then you will need to format it, via something like:~~

	~~<code>mkfs.ext4 /dev/mapper/dm_name</code>~~

CRYSTL: reworked this page

2026-07-01T01:20:11Z

reworked this page

Show changes

VV at 00:00, 1 July 2026

2026-07-01T00:00:15Z

← Older revision		Revision as of 00:00, 1 July 2026
Line 1:		Line 1:
	{{Draft}}{{Guide		{{Draft}}{{Guide
	\| 0 = ~~advanced~~		\| 0 = Advanced
	}}For more more info on this topic, check the [https://gitlab.com/cryptsetup/cryptsetup/-/wikis/FrequentlyAskedQuestions cryptsetup FAQ], the [https://wiki.archlinux.org/title/Dm-crypt/Device_encryption Arch Wiki].		}}For more more info on this topic, check the [https://gitlab.com/cryptsetup/cryptsetup/-/wikis/FrequentlyAskedQuestions cryptsetup FAQ], the [https://wiki.archlinux.org/title/Dm-crypt/Device_encryption Arch Wiki].

CRYSTL: finish copying over data from the intermediate page . this page still needs a lot of cleanup and addition though .

2026-06-17T02:57:15Z

finish copying over data from the intermediate page . this page still needs a lot of cleanup and addition though .

@@ Line 1: / Line 1: @@
 {{Draft}}{{Guide
-| 0 = Advanced
+| 0 = advanced
 }}For more more info on this topic, check the [https://gitlab.com/cryptsetup/cryptsetup/-/wikis/FrequentlyAskedQuestions cryptsetup FAQ], the [https://wiki.archlinux.org/title/Dm-crypt/Device_encryption Arch Wiki].
 = Guide to Decent LUKS Security on Linux =
-The Main Page gives a high level overview of what different LUKS options can do, but this page intends to go into as much detail as possible about them while still aiming to be easy to understand.
+The Main Page gives a high level overview of what different LUKS options can do, but this page intends to go into as much detail as possible about them while still aiming to be easy to understand. If you just want to know the "best" [[command]] to run, you can skip to the bottom. But reading this Guide is encouraged, as it will give you a better understand of what the options do, and how they will affect the security of your data!
 == Ciphers ==
@@ Line 21: / Line 21: @@
 == On-disk Format ==
 The on-disk format defines how the encrypted data is stored on the disk itself . While you ''could'' just write the encrypted blocks directly to the disk , you would be at risk of a number of different attacks . CBC ( Cipher-block chaining ) is an older on-disk format and should not really be used . It has malleability vulnerabilities ( meaning data can be inserted without knowing the encryption key ) , and also , specially-crafted files can be " fingerprinted " , meaning they can be located on the disk . XTS ( XEX-based tweaked-codebook mode with ciphertext stealing ) is better at mitigating these issues , so it's the recommended default . It's also usually hardware accelerated on x86 . XTS does have its own vulnerabilities , but most of these issues can be mitigated by using a filesystem that can verify and repair corrupted data , like ZFS or BTRFS .

VV at 02:17, 17 June 2026

2026-06-17T02:17:56Z

← Older revision		Revision as of 02:17, 17 June 2026
Line 1:		Line 1:
	{{Draft}}{{Guide		{{Draft}}{{Guide
	\| 0 = ~~advanced~~		\| 0 = Advanced
	}}For more more info on this topic, check the [https://gitlab.com/cryptsetup/cryptsetup/-/wikis/FrequentlyAskedQuestions cryptsetup FAQ], the [https://wiki.archlinux.org/title/Dm-crypt/Device_encryption Arch Wiki].		}}For more more info on this topic, check the [https://gitlab.com/cryptsetup/cryptsetup/-/wikis/FrequentlyAskedQuestions cryptsetup FAQ], the [https://wiki.archlinux.org/title/Dm-crypt/Device_encryption Arch Wiki].

VV: remove "main page" link

2026-06-17T01:47:07Z

remove "main page" link

← Older revision		Revision as of 01:47, 17 June 2026
Line 1:		Line 1:
	{{Draft~~}}{{Main\|LUKS~~}}{{Guide		{{Draft}}{{Guide
	\| 0 = advanced		\| 0 = advanced
	}}For more more info on this topic, check the [https://gitlab.com/cryptsetup/cryptsetup/-/wikis/FrequentlyAskedQuestions cryptsetup FAQ], the [https://wiki.archlinux.org/title/Dm-crypt/Device_encryption Arch Wiki].		}}For more more info on this topic, check the [https://gitlab.com/cryptsetup/cryptsetup/-/wikis/FrequentlyAskedQuestions cryptsetup FAQ], the [https://wiki.archlinux.org/title/Dm-crypt/Device_encryption Arch Wiki].

VV at 01:12, 17 June 2026

2026-06-17T01:12:00Z

← Older revision		Revision as of 01:12, 17 June 2026
Line 1:		Line 1:
	{{Draft}}{{Guide		{{Draft}}{{Main\|LUKS}}{{Guide
	\| 0 = advanced		\| 0 = advanced
	}}~~{{Main\|LUKS}}~~		}}For more more info on this topic, check the [https://gitlab.com/cryptsetup/cryptsetup/-/wikis/FrequentlyAskedQuestions cryptsetup FAQ], the [https://wiki.archlinux.org/title/Dm-crypt/Device_encryption Arch Wiki].

	For more more info on this topic, check the [https://gitlab.com/cryptsetup/cryptsetup/-/wikis/FrequentlyAskedQuestions cryptsetup FAQ], the [https://wiki.archlinux.org/title/Dm-crypt/Device_encryption Arch Wiki].

	= Guide to Decent LUKS Security on Linux =		= Guide to Decent LUKS Security on Linux =

VV at 01:08, 17 June 2026

2026-06-17T01:08:13Z

← Older revision		Revision as of 01:08, 17 June 2026
Line 2:		Line 2:
	\| 0 = advanced		\| 0 = advanced
	}}{{Main\|LUKS}}		}}{{Main\|LUKS}}

	~~This page is written with [[Tiers\|Advanced]] users in mind, but of course everyone is encouraged to try to understand.~~

	For more more info on this topic, check the [https://gitlab.com/cryptsetup/cryptsetup/-/wikis/FrequentlyAskedQuestions cryptsetup FAQ], the [https://wiki.archlinux.org/title/Dm-crypt/Device_encryption Arch Wiki].		For more more info on this topic, check the [https://gitlab.com/cryptsetup/cryptsetup/-/wikis/FrequentlyAskedQuestions cryptsetup FAQ], the [https://wiki.archlinux.org/title/Dm-crypt/Device_encryption Arch Wiki].

VV: Add Guide template

2026-06-17T01:07:54Z

Add Guide template

← Older revision		Revision as of 01:07, 17 June 2026
Line 1:		Line 1:
	{{Draft}}{{Main\|LUKS}}		{{Draft}}{{Guide
			\| 0 = advanced
			}}{{Main\|LUKS}}

	This page is written with [[Tiers\|Advanced]] users in mind, but of course everyone is encouraged to try to understand.		This page is written with [[Tiers\|Advanced]] users in mind, but of course everyone is encouraged to try to understand.