I have been researching LUKS vs TrueCrypt topics -- my only concern is security, but most of the discussions I see focus around usability / interoperability .

I know TrueCrypt has a bunch of nice passphrase features -- slow hashing algorithm, thousands of iterations, options for multiple keyfiles etc. These features make me feel that secret key security of the encrypted data is quite strong. But I do not know what LUKS does in this respect. I know in TrueCrypt if I make my passhphrase "abc" the final encryption key will not be "abc" it will be the result of some slow hash -- but if I use LUKS what will my key look like if the passphrase is "abc".

(This is a hypothetical example, I don't intend to use a three character passphrase ... I just need to demonstrate my point -- please no discussion of weak passphrases here, I know all about that, assume I will use the maximum amount of characters for any passphrase, LUKS or TrueCrypt.)

Also, I know TrueCrypt offers other features, such as multi-layered encryption with different algorithms and different keys. That sounds like a really good measure, does LUKS have any option like this? When I install the OS (MINT) I only have a checkbox option yes or no to encrypt. I don't see any further configuration options when installing. What are the defaults?

My primary concern here is that while I know a bit about TrueCrypt, and how it works with regards to my security desires, I have no idea how LUKS behaves. Let's say LUKS out of the box does not offer multi-layer encryption or slow hashing, is there a way to enable this post-install? What does it entail to change the LUKS configurations from an existing weaker installation to a stronger one more suited towards the features of TrueCrypt that appeal to me?

To re-iterate, I don't want a discussion of usability. Yes, I have heard the discussion of "poor usability is poor security", but in this case, even if my data isn't so sensitive it needs to be hidden from extra-terrestrial hackers with state financing. Consider this a practice environment to teach myself the strictest and most secure setup. If I suffer a usability related security weakness (human error) then I am to learn from such a mistake.

Thanks for the input, it's always very appreciated.

  • An article in IT World for September 29, 2015 (itworld.com/article/2987438/data-protection/…) reveals the existence of, but doesn't describe fully, two serious flaws in the Windows driver that TrueCrypt installs. It isn't clear from the article whether those flaws compromise the crypto or the underlying Windows OS, or both. It also isn't clear whether that driver is installed only for full-disk encryption or at any time a TrueCrypt volume is in use.
    – Bob Brown
    Oct 4, 2015 at 18:18

2 Answers 2


The answers you're looking for can be found in the Cryptsetup documentation, but to summarize:

  1. LUKS uses PBKDF2 to derive a "slot key" from your password, with a default iteration count sufficient to take one second on the computer that created the LUKS volume.
  2. This "slot key" is unrelated to the key used to encrypt your data. It is only used to decrypt a copy of the volume master key, which is then used to encrypt/decrypt the data.
  3. You can have up to eight different passwords for unlocking the volume.
  4. Each slot key can have its own derivation function. If you find that one second of PBKDF2 doesn't fit your needs, you can add a new password with different parameters and erase the old one.
  5. There is no support for changing the encryption on a LUKS volume after it has been created.
  6. When creating a LUKS volume from the command line, you can specify the cipher used. The default is "aes-xts-plain64" (AES-128 encryption in XTS mode with no hash function). LUKS does not support layered encryption algorithms.
  7. LUKS does not support hidden volumes the way Truecrypt does, but given that everyone and their dog knows about Truecrypt's hidden-volume support, these "hidden" volumes can't be considered at all secret in the real-world (as opposed to the information-theoretic) sense.
  • 1
    I know this answer is two years old, but I just want to answer to 7. : I think the main advantage of hidden volumes is that even if one knows they exist, nobody can prove that there is in fact a hidden volume in a regular volume without knowing the passphrase. It's therefore a very effective feature.
    – Hey
    Mar 29, 2016 at 19:12
  • 2
    It's only an effective feature if cryptanalysis is limited to mathematical techniques. If the investigation can use a $5 wrench, hidden-volume functionality shifts the burden of proof: it's now up to you to prove that the hidden volume doesn't exist.
    – Mark
    Mar 29, 2016 at 19:23
  • But you can't prove it, so if you are in the hands of such irrational people, you will be beaten anyway.
    – Hey
    Mar 29, 2016 at 20:09
  • @YdobEmos Real security is more related to be smart than to be strong. Create the hidden device, let them the key. Save the real hidden data into a sdcard and that's all. If i erease the whole disk in your face, your eyes will told me if there's any hidden volume. If i cut you a finger, your mouth will told me if there's any hidden volume. Your BEST chance is to create one and put dummy shit on it. Then use a 2nd drive like a sdcard to put data then remove and hide it when you don't really use it. Destroying a sdcard is easiest than destroy a sata disk content. Do not trust SSD controllers.
    – m3nda
    Jan 24, 2017 at 13:47
  • @YdobEmos in fact, using veracrypt and hidden volumes daily is your best chance to add noise. If you have 20 devices in your logs, better than just 1. You only need to save the real device, then you're ok. If you delete all logs, you'll be flagged as even more suspicious. Be smart and save your fingers :-)
    – m3nda
    Jan 24, 2017 at 13:49

The disk encrypted by TrueCrypt looks like random data. It has no header, everything is encrypted. Nobody can even prove it contains any data.

LUKS has a header and it could be proven easily that the disk contains LUKS encrypted data. If the police confiscated your laptop on UK borders and they saw it contains LUKS partition they could hold you in the jail until you reveal the password. If you had the partition encrypted by TrueCrypt you can claim it was just securely deleted - at least the negotiation would be easier.

TrueCrypt is death project. It is a big piece of code hard to verify. However, there is a replacement:


tcplay has very short code. It can mount and create TrueCrypt images. I made an audit by myself and I can claim it is secure :-).

  • VeraCrypt is the live TrueCrypt alternative Dec 9, 2016 at 13:54
  • yes, but it inherited old TrueCrypt code and so it has the same problem. Large code which is difficult to verify.
    – smrt28
    Dec 9, 2016 at 16:36
  • What problem you mean? Dec 9, 2016 at 16:49
  • the problem is the large piece of code which is difficult to verify
    – smrt28
    Dec 11, 2016 at 11:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .