LUKS: Difference between revisions
link to linux anatomy |
No edit summary |
||
| (One intermediate revision by the same user not shown) | |||
| Line 4: | Line 4: | ||
Some external information that may also be helpful is the [https://gitlab.com/cryptsetup/cryptsetup/-/wikis/FrequentlyAskedQuestions cryptsetup FAQ] and [https://wiki.archlinux.org/title/Dm-crypt/Device_encryption Arch Wiki]. | Some external information that may also be helpful is the [https://gitlab.com/cryptsetup/cryptsetup/-/wikis/FrequentlyAskedQuestions cryptsetup FAQ] and [https://wiki.archlinux.org/title/Dm-crypt/Device_encryption Arch Wiki]. | ||
== Guide to Decent LUKS | == Guide to Decent LUKS Security on Linux == | ||
LUKS is the [[Linux anatomy|Linux]] Unified Key Setup. This guide explains all of the different part of the LUKS system and why they are important for [[Glossary#Security|security]]. Check out the advanced guide if you want to know more about how to set these options and what they do in more detail. | |||
== Ciphers == | === Ciphers === | ||
Ciphers scramble the [[files]] that will be saved, so it's important to pick a good one. Almost all computers have, for many decades now, have had built in support for [[AES]], making it the fastest and most secure option for pretty much everyone. | Ciphers scramble the [[files]] that will be saved, so it's important to pick a good one. Almost all computers have, for many decades now, have had built in support for [[AES]], making it the fastest and most secure option for pretty much everyone. | ||
== On-disk [[Format]] == | === On-disk [[Format]] === | ||
The on-disk format helps prevent the scrambled files from being modified while the computer is turned off. Since most computers already have built in support for [[XTS]], it makes it the fastest and most secure option. | The on-disk format helps prevent the scrambled files from being modified while the computer is turned off. Since most computers already have built in support for [[XTS]], it makes it the fastest and most secure option. | ||
== [[Initialization]] [[Vectors]] ( IV ) == | === [[Initialization]] [[Vectors]] ( IV ) === | ||
By looking at the scrambled files on the disk, it is possible to find some patterns like, for example, images. IV helps prevent this! If you're using XTS, [[plain64]] is the fastest and most secure option. | By looking at the scrambled files on the disk, it is possible to find some patterns like, for example, images. IV helps prevent this! If you're using XTS, [[plain64]] is the fastest and most secure option. | ||
== [[Password]] [[Hashing]] == | === [[Password]] [[Hashing]] === | ||
Password hashing helps make passwords that are not secure harder to break. A ''very'' secure password needs no hashing, but since making a very secure password is difficult, it's a good idea to use hashing. [[Argon2]] is the most secure option for most users. | Password hashing helps make passwords that are not secure harder to break. A ''very'' secure password needs no hashing, but since making a very secure password is difficult, it's a good idea to use hashing. [[Argon2]] is the most secure option for most users. | ||
== [[Iteration]] Time == | === [[Iteration]] Time === | ||
Since some computers are faster than others, your computer will test to see how many times it can hash your password in this amount of time. The default is 2 seconds, and that's usually good enough. If your computer is very slow, and you're OK with waiting a bit longer for a more secure hash, you may wanna set it for a bit longer! | Since some computers are faster than others, your computer will test to see how many times it can hash your password in this amount of time. The default is 2 seconds, and that's usually good enough. If your computer is very slow, and you're OK with waiting a bit longer for a more secure hash, you may wanna set it for a bit longer! | ||
| Line 39: | Line 39: | ||
<code>/dev/mapper/dm_name</code> | <code>/dev/mapper/dm_name</code> | ||
To [[format]] it, you can use the following: | |||
<code>mkfs.ext4 /dev/mapper/dm_name</code> | <code>mkfs.ext4 /dev/mapper/dm_name</code> | ||