I was just curious if someone had a high level overview of how a system like LUKS worked for full disk encryption, aka. how it stores keys and how those keys are verified, and if data is de-crypted by a wrapper for all standard i/o. I've seen partial explanations elsewhere but never a full high level explanation.

  • Did you read LUKS' user documentation? The kernel documentation? Do you want to know about LUKS from the perspective of the user, as someone that want to hack on the kernel, or for evaluating the security for a particular purpose? Is there any thing specifically about LUKS that you wanted to know? Does it have to be LUKS or are you just interested about FDE in general?
    – Lie Ryan
    Aug 11, 2016 at 7:01
  • I did not read the kernel documentation. I read different user docs. I'm interested more in FDE on linux than specifically LUKS. And I'm interested in evaluating it for security purposes.
    – fritz
    Aug 11, 2016 at 14:53

1 Answer 1


I'm going to tell you what components compose the LUKS and how to they interact at a high level (I will not tell you the format of the metadata and how it is used).

This disk encryption solution is formed of two components: cryptsetup(userspace) and dm-crypt(kernelspace, Linux Kernel module).

cryptsetup is used to format the block device and to open the block device. Upon formatting and opening of the device you send the keys into kernelspace. The dm-crypt module instantiates an encryption context where it stores the session data/encryption key (CryptoAPI is the module inside the Linux Kernel that deals with all the criptography, it has criptographic accelerators support, etc). After you actually mount that block device, when you write/read to/from it, everything goes through that context.

Not the answer you're looking for? Browse other questions tagged or ask your own question.