LUKS/Advanced: Difference between revisions

Line 70:

An easy way to ensure you have enough entropy, is to gather it from an external source. For example, you can run: <code>curl -Ss <nowiki>https://www.random.org/cgi-bin/randbyte?nbytes=16384&format=f</nowiki> > /dev/random</code>. This command gathers random bytes from [https://random.org random.org]. Using an external source like this is ok, since Linux has ways to gather entropy besides this that an attacker would not be able to replicate.

~~== Disk Setup ==~~

~~Assuming you know what partition you want to use, setting up the disk is as simple as:~~

~~<code>cryptsetup luksFormat --type luks2 --cipher aes-xts-plain64 --hash sha256 --iter-time 2000 --key-size 256 --pbkdf argon2id --use-random --verify-passphrase /dev/YOURPARTITIONHERE</code>~~

As mentioned previously, these settings are the default on the latest cryptsetup (with the exception of <code>--use-random</code>). Setting them manually ensures that they are correct on older versions. You can check what the defaults are for your system by running <code>cryptsetup --help</code>. You can then verify that it was setup correctly with:

~~<code>cryptsetup luksDump /dev/YOURPARTITIONHERE</code>~~

~~Once it has been setup, it can be opened with:~~

~~<code>cryptsetup open /dev/YOURPARTITIONHERE dm_name</code>~~

~~Note that "dm_name" can be set to whatever you like, and the disk will be available at:~~

~~<code>/dev/mapper/dm_name</code>~~

~~Then you will need to format it, via something like:~~

~~<code>mkfs.ext4 /dev/mapper/dm_name</code>~~

@@ Line 70: / Line 70: @@
 An easy way to ensure you have enough entropy, is to gather it from an external source. For example, you can run: <code>curl -Ss <nowiki>https://www.random.org/cgi-bin/randbyte?nbytes=16384&format=f</nowiki> > /dev/random</code>. This command gathers random bytes from [https://random.org random.org]. Using an external source like this is ok, since Linux has ways to gather entropy besides this that an attacker would not be able to replicate.
-== Disk Setup ==
-Assuming you know what partition you want to use, setting up the disk is as simple as:
-<code>cryptsetup luksFormat --type luks2 --cipher aes-xts-plain64 --hash sha256 --iter-time 2000 --key-size 256 --pbkdf argon2id --use-random --verify-passphrase /dev/YOURPARTITIONHERE</code>
-As mentioned previously, these settings are the default on the latest cryptsetup (with the exception of <code>--use-random</code>). Setting them manually ensures that they are correct on older versions. You can check what the defaults are for your system by running <code>cryptsetup --help</code>. You can then verify that it was setup correctly with:
-<code>cryptsetup luksDump /dev/YOURPARTITIONHERE</code>
-Once it has been setup, it can be opened with:
-<code>cryptsetup open /dev/YOURPARTITIONHERE dm_name</code>
-Note that "dm_name" can be set to whatever you like, and the disk will be available at:
-<code>/dev/mapper/dm_name</code>
-Then you will need to format it, via something like:
-<code>mkfs.ext4 /dev/mapper/dm_name</code>