LUKS/Advanced - Revision history

CRYSTL: finish copying over data from the intermediate page . this page still needs a lot of cleanup and addition though .

2026-06-17T02:57:15Z

finish copying over data from the intermediate page . this page still needs a lot of cleanup and addition though .

@@ Line 1: / Line 1: @@
 {{Draft}}{{Guide
-| 0 = Advanced
+| 0 = advanced
 }}For more more info on this topic, check the [https://gitlab.com/cryptsetup/cryptsetup/-/wikis/FrequentlyAskedQuestions cryptsetup FAQ], the [https://wiki.archlinux.org/title/Dm-crypt/Device_encryption Arch Wiki].
 = Guide to Decent LUKS Security on Linux =
-The Main Page gives a high level overview of what different LUKS options can do, but this page intends to go into as much detail as possible about them while still aiming to be easy to understand.
+The Main Page gives a high level overview of what different LUKS options can do, but this page intends to go into as much detail as possible about them while still aiming to be easy to understand. If you just want to know the "best" [[command]] to run, you can skip to the bottom. But reading this Guide is encouraged, as it will give you a better understand of what the options do, and how they will affect the security of your data!
 == Ciphers ==
@@ Line 21: / Line 21: @@
 == On-disk Format ==
 The on-disk format defines how the encrypted data is stored on the disk itself . While you ''could'' just write the encrypted blocks directly to the disk , you would be at risk of a number of different attacks . CBC ( Cipher-block chaining ) is an older on-disk format and should not really be used . It has malleability vulnerabilities ( meaning data can be inserted without knowing the encryption key ) , and also , specially-crafted files can be " fingerprinted " , meaning they can be located on the disk . XTS ( XEX-based tweaked-codebook mode with ciphertext stealing ) is better at mitigating these issues , so it's the recommended default . It's also usually hardware accelerated on x86 . XTS does have its own vulnerabilities , but most of these issues can be mitigated by using a filesystem that can verify and repair corrupted data , like ZFS or BTRFS .

VV at 02:17, 17 June 2026

2026-06-17T02:17:56Z

← Older revision		Revision as of 02:17, 17 June 2026
Line 1:		Line 1:
	{{Draft}}{{Guide		{{Draft}}{{Guide
	\| 0 = ~~advanced~~		\| 0 = Advanced
	}}For more more info on this topic, check the [https://gitlab.com/cryptsetup/cryptsetup/-/wikis/FrequentlyAskedQuestions cryptsetup FAQ], the [https://wiki.archlinux.org/title/Dm-crypt/Device_encryption Arch Wiki].		}}For more more info on this topic, check the [https://gitlab.com/cryptsetup/cryptsetup/-/wikis/FrequentlyAskedQuestions cryptsetup FAQ], the [https://wiki.archlinux.org/title/Dm-crypt/Device_encryption Arch Wiki].

VV: remove "main page" link

2026-06-17T01:47:07Z

remove "main page" link

← Older revision		Revision as of 01:47, 17 June 2026
Line 1:		Line 1:
	{{Draft~~}}{{Main\|LUKS~~}}{{Guide		{{Draft}}{{Guide
	\| 0 = advanced		\| 0 = advanced
	}}For more more info on this topic, check the [https://gitlab.com/cryptsetup/cryptsetup/-/wikis/FrequentlyAskedQuestions cryptsetup FAQ], the [https://wiki.archlinux.org/title/Dm-crypt/Device_encryption Arch Wiki].		}}For more more info on this topic, check the [https://gitlab.com/cryptsetup/cryptsetup/-/wikis/FrequentlyAskedQuestions cryptsetup FAQ], the [https://wiki.archlinux.org/title/Dm-crypt/Device_encryption Arch Wiki].

VV at 01:12, 17 June 2026

2026-06-17T01:12:00Z

← Older revision		Revision as of 01:12, 17 June 2026
Line 1:		Line 1:
	{{Draft}}{{Guide		{{Draft}}{{Main\|LUKS}}{{Guide
	\| 0 = advanced		\| 0 = advanced
	}}~~{{Main\|LUKS}}~~		}}For more more info on this topic, check the [https://gitlab.com/cryptsetup/cryptsetup/-/wikis/FrequentlyAskedQuestions cryptsetup FAQ], the [https://wiki.archlinux.org/title/Dm-crypt/Device_encryption Arch Wiki].

	For more more info on this topic, check the [https://gitlab.com/cryptsetup/cryptsetup/-/wikis/FrequentlyAskedQuestions cryptsetup FAQ], the [https://wiki.archlinux.org/title/Dm-crypt/Device_encryption Arch Wiki].

	= Guide to Decent LUKS Security on Linux =		= Guide to Decent LUKS Security on Linux =

VV at 01:08, 17 June 2026

2026-06-17T01:08:13Z

← Older revision		Revision as of 01:08, 17 June 2026
Line 2:		Line 2:
	\| 0 = advanced		\| 0 = advanced
	}}{{Main\|LUKS}}		}}{{Main\|LUKS}}

	~~This page is written with [[Tiers\|Advanced]] users in mind, but of course everyone is encouraged to try to understand.~~

	For more more info on this topic, check the [https://gitlab.com/cryptsetup/cryptsetup/-/wikis/FrequentlyAskedQuestions cryptsetup FAQ], the [https://wiki.archlinux.org/title/Dm-crypt/Device_encryption Arch Wiki].		For more more info on this topic, check the [https://gitlab.com/cryptsetup/cryptsetup/-/wikis/FrequentlyAskedQuestions cryptsetup FAQ], the [https://wiki.archlinux.org/title/Dm-crypt/Device_encryption Arch Wiki].

VV: Add Guide template

2026-06-17T01:07:54Z

Add Guide template

← Older revision		Revision as of 01:07, 17 June 2026
Line 1:		Line 1:
	{{Draft}}{{Main\|LUKS}}		{{Draft}}{{Guide
			\| 0 = advanced
			}}{{Main\|LUKS}}

	This page is written with [[Tiers\|Advanced]] users in mind, but of course everyone is encouraged to try to understand.		This page is written with [[Tiers\|Advanced]] users in mind, but of course everyone is encouraged to try to understand.

CRYSTL: CRYSTL moved page Luks (Advanced) to LUKS/Advanced

2026-06-17T00:21:37Z

CRYSTL moved page Luks (Advanced) to LUKS/Advanced

← Older revision		Revision as of 00:21, 17 June 2026
(No difference)

CRYSTL: add draft link as well as ODF section

2026-06-16T23:52:52Z

add draft link as well as ODF section

← Older revision		Revision as of 23:52, 16 June 2026
Line 1:		Line 1:
	{{Main\|LUKS}}		{{Draft}}{{Main\|LUKS}}

	This page is written with [[Tiers\|Advanced]] users in mind, but of course everyone is encouraged to try to understand.		This page is written with [[Tiers\|Advanced]] users in mind, but of course everyone is encouraged to try to understand.
Line 11:		Line 11:
	Ciphers are the [[algorithms]] used to [[Encryption\|encrypt]] [[data]]. Picking the best algorithm is very important for ensuring your data is secure. If your cipher can be broken, then your data can be accessed without the key.		Ciphers are the [[algorithms]] used to [[Encryption\|encrypt]] [[data]]. Picking the best algorithm is very important for ensuring your data is secure. If your cipher can be broken, then your data can be accessed without the key.

	Of the widely supported options, the two most worth considering are Serpent and AES.		Of the widely supported options, the two most worth considering are [[Serpent]] and [[AES]].

	Twofish ''may'' be better in lower-security applications where there's no AES acceleration ''and'' writes happen more often than reads, but generally, not a great option.		Twofish ''may'' be better in lower-security applications where there's no AES acceleration ''and'' writes happen more often than reads, but generally, not a great option.
Line 20:		Line 20:

	On the other hand, having hardware acceleration for AES has a number of advantages for security, most notably resistance to side channel attacks, and of course, speed. Some chips however, almost always not x86, do not have hardware accelerated AES. It's also possible that your CPU may have a vulnerability, so that's something you may want to look into. As far as we are aware though, no vulnerabilities have been reported on any present or past chip with AES support. Practically speaking, the advantages of having hardware accelerated AES make it more secure than using Serpent in nearly all cases.		On the other hand, having hardware acceleration for AES has a number of advantages for security, most notably resistance to side channel attacks, and of course, speed. Some chips however, almost always not x86, do not have hardware accelerated AES. It's also possible that your CPU may have a vulnerability, so that's something you may want to look into. As far as we are aware though, no vulnerabilities have been reported on any present or past chip with AES support. Practically speaking, the advantages of having hardware accelerated AES make it more secure than using Serpent in nearly all cases.

			== On-disk Format ==
			The on-disk format defines how the encrypted data is stored on the disk itself . While you ''could'' just write the encrypted blocks directly to the disk , you would be at risk of a number of different attacks . CBC ( Cipher-block chaining ) is an older on-disk format and should not really be used . It has malleability vulnerabilities ( meaning data can be inserted without knowing the encryption key ) , and also , specially-crafted files can be " fingerprinted " , meaning they can be located on the disk . XTS ( XEX-based tweaked-codebook mode with ciphertext stealing ) is better at mitigating these issues , so it's the recommended default . It's also usually hardware accelerated on x86 . XTS does have its own vulnerabilities , but most of these issues can be mitigated by using a filesystem that can verify and repair corrupted data , like ZFS or BTRFS .

CRYSTL: added external wiki links

2026-06-16T23:38:34Z

added external wiki links

← Older revision		Revision as of 23:38, 16 June 2026
Line 3:		Line 3:
	This page is written with [[Tiers\|Advanced]] users in mind, but of course everyone is encouraged to try to understand.		This page is written with [[Tiers\|Advanced]] users in mind, but of course everyone is encouraged to try to understand.

	For more more info on this topic, check the cryptsetup FAQ, the Arch Wiki. ~~'''TODO!!! LINK THESE'''~~		For more more info on this topic, check the [https://gitlab.com/cryptsetup/cryptsetup/-/wikis/FrequentlyAskedQuestions cryptsetup FAQ], the [https://wiki.archlinux.org/title/Dm-crypt/Device_encryption Arch Wiki].

	= Guide to Decent LUKS Security on Linux =		= Guide to Decent LUKS Security on Linux =

CRYSTL: added ciphers block

2026-05-10T18:04:05Z

added ciphers block

New page

{{Main|LUKS}}

This page is written with [[Tiers|Advanced]] users in mind, but of course everyone is encouraged to try to understand.

For more more info on this topic, check the cryptsetup FAQ, the Arch Wiki. '''TODO!!! LINK THESE'''

= Guide to Decent LUKS Security on Linux =
The Main Page gives a high level overview of what different LUKS options can do, but this page intends to go into as much detail as possible about them while still aiming to be easy to understand.

== Ciphers ==
Ciphers are the [[algorithms]] used to [[Encryption|encrypt]] [[data]]. Picking the best algorithm is very important for ensuring your data is secure. If your cipher can be broken, then your data can be accessed without the key.

Of the widely supported options, the two most worth considering are Serpent and AES.

Twofish ''may'' be better in lower-security applications where there's no AES acceleration ''and'' writes happen more often than reads, but generally, not a great option.

Serpent may theoretically be more secure, though in practice its potential advantages seem pretty minimal. It also hasn't been tested as much as AES, so it ''may'' have potential vulnerabilities not yet known about .

Another consideration is the actual implementation. Serpent has potential vulnerabilities depending on the details of the implementation. Without looking into the specific implementation in-depth, it's hard to say how secure it is.

On the other hand, having hardware acceleration for AES has a number of advantages for security, most notably resistance to side channel attacks, and of course, speed. Some chips however, almost always not x86, do not have hardware accelerated AES. It's also possible that your CPU may have a vulnerability, so that's something you may want to look into. As far as we are aware though, no vulnerabilities have been reported on any present or past chip with AES support. Practically speaking, the advantages of having hardware accelerated AES make it more secure than using Serpent in nearly all cases.