LUKS

This is an Intermediate complexity guide. All versions:

• Intermediate
• Advanced

Some external information that may also be helpful is the cryptsetup FAQ and Arch Wiki.

Guide to Decent LUKS Security on Linux

LUKS is the Linux Unified Key Setup. This guide explains all of the different part of the LUKS system and why they are important for security. Check out the advanced guide if you want to know more about how to set these options and what they do in more detail.

Ciphers

Ciphers scramble the files that will be saved, so it's important to pick a good one. Almost all computers have, for many decades now, have had built in support for AES, making it the fastest and most secure option for pretty much everyone.

On-disk Format

The on-disk format helps prevent the scrambled files from being modified while the computer is turned off. Since most computers already have built in support for XTS, it makes it the fastest and most secure option.

Initialization Vectors ( IV )

By looking at the scrambled files on the disk, it is possible to find some patterns like, for example, images. IV helps prevent this! If you're using XTS, plain64 is the fastest and most secure option.

Password Hashing

Password hashing helps make passwords that are not secure harder to break. A very secure password needs no hashing, but since making a very secure password is difficult, it's a good idea to use hashing. Argon2 is the most secure option for most users.

Iteration Time

Since some computers are faster than others, your computer will test to see how many times it can hash your password in this amount of time. The default is 2 seconds, and that's usually good enough. If your computer is very slow, and you're OK with waiting a bit longer for a more secure hash, you may wanna set it for a bit longer!

Disk Setup

Assuming you know what partition you want to use, setting up the disk is as simple as:

cryptsetup luksFormat --type luks2 --cipher aes-xts-plain64 --hash sha256 --iter-time 2000 --key-size 256 --pbkdf argon2id --use-random --verify-passphrase /dev/YOURPARTITIONHERE

As mentioned previously, these settings are the default on the latest cryptsetup (with the exception of --use-random). Setting them manually ensures that they are correct on older versions. You can check what the defaults are for your system by running cryptsetup --help. You can then verify that it was setup correctly with:

cryptsetup luksDump /dev/YOURPARTITIONHERE

Once it has been setup, it can be opened with:

cryptsetup open /dev/YOURPARTITIONHERE dm_name

Note that "dm_name" can be set to whatever you like, and the disk will be available at:

/dev/mapper/dm_name

To format it, you can use the following:

mkfs.ext4 /dev/mapper/dm_name