Skip to main content

Questions tagged [luks]

LUKS (Linux Unified Key Setup) is a disk-encryption specification.

Filter by
Sorted by
Tagged with
93 votes
2 answers

How secure is Ubuntu's default full-disk encryption?

How secure is the encryption offered by ubuntu (using the disk utility)? What algorithm is used underneath it? If someone could at least provide a link to some documentation or article regarding that ...
Jonnathan Soares's user avatar
29 votes
2 answers

Right way to use the TPM for full disk encryption

I'm currently setting up a BitLocker equivalent using a TPM and LUKS. I've got the basics right and I'm able to measure the boot process and seal the FDE key using the TPM. Every time the sensitive ...
André Borie's user avatar
  • 12.8k
32 votes
5 answers

What does LUKS header contain?

What is contained inside the LUKS header? I know, the header has size of 2MB. Also, cryptsetup supports "detached header", where the header can be stored in a separate file. Thus, for example, I can ...
Martin Vegter's user avatar
28 votes
3 answers

For LUKS: The most preferable and safest cipher?

I'm about to encrypt two of my hard drives using LUKS, since I can't really do it myself I use the guide on the Arch Linux wiki (which can be found here). In an example in the guide the cipher ...
Peter's user avatar
  • 281
7 votes
2 answers

For remotely unlocking LUKS volumes via SSH, how can I verify integrity before sending passphrase?

Although this is closely related to the recently closed question Evil maids in the server room [closed], I believe that it's more answerable. I'd like to unlock LUKS volumes on remotely hosted ...
mirimir's user avatar
  • 746
27 votes
2 answers

Recommended options for LUKS (cryptsetup)

I'm looking for recommended options for cryptsetup to create fully encrypted SSD (SanDisk SSD U100 128GB), which achive: Timing O_DIRECT disk reads: 1476 MB in 3.00 seconds = 491.81 MB/sec Timing ...
Artur Szymczak's user avatar
12 votes
1 answer

Using TPM with well-known SRK/owner passwords?

First, I will explain roughly how I plan to use the TPM: I am using something called tpm-luks which stores a key in both TPM NVRAM and adds the key to one of the LUKS keyslots. The initramfs then ...
mmtauqir's user avatar
  • 281
5 votes
1 answer

Does full disk encryption offer mitigation in the case of the firmware of an SSD being compromised?

Suppose the firmware of an SSD or HDD has been compromised by rogue actors either through "interdiction" (interception) or via the internet. They are able to exfiltrate data and conduct surveillance ...
ssdhddinfected's user avatar
2 votes
1 answer

dm-crypt 2.0.3 + luks: salt auto-generated? what affects decryption speed?

I am trying to encrypt one of my primary Linux partition (5GB) by following this example to encrypt. I want to confirm some of my understandings: Salt is automatically generated by cyrptsetup with ...
HCSF's user avatar
  • 153
2 votes
1 answer

How to determine start and end bytes of LUKS header?

How can I determine the exact start byte and exact end byte of a LUKS header on a block storage device? I use Linux Unified Key Setup (LUKS) for Full Disk Encryption (FDE), so all of the data on my ...
Michael Altfield's user avatar
1 vote
1 answer

Why is my LUKS header listed twice?

Why is the metadata in my LUKS header listed twice? I started poking at the bits in a drive that's encrypted with LUKS, and I found some metadata in a JSON object. What's odd though is that the same ...
Michael Altfield's user avatar
0 votes
1 answer

Do LUKS2 encrypted partitions with Keyfiles use a KDF?

I gather from the cryptsetup manpages that LUKS2 uses argon2i by default for strengthening a user-password to decrypt the partition. However if a 256 bit keyfile with data from /dev/random, how does a ...
jaaq's user avatar
  • 125
51 votes
5 answers

Are there any reasonable TrueCrypt forks?

Unfortunately, TrueCrypt may have been discontinued yesterday. I use LUKS on Linux, but I liked the fact that with TrueCrypt I had a portable solution across Windows, Mac, & Linux. TrueCrypt ...
Michał Šrajer's user avatar
48 votes
4 answers

Aren't keyfiles defeating the purpose of encryption?

I just added a drive to my system which is basically a partition mounted for extra storage. I'd like to encrypt it to protect my data in case of god knows what, and by doing that I'd need to enter the ...
php_nub_qq's user avatar
13 votes
3 answers

LUKS, how to make strongest possible and reasonable passphrase?

Let us say I have a volume encrypted under LUKS with a 512-bit key. That would mean there are 2 ^ 512 possible values which the key may be. Now I need a passphrase which is at least as resistant to ...
Radmilla Mustafa's user avatar
10 votes
2 answers

Filling the disk with random data prior to encryption?

Filling the disk with random data prior to encrypting it will supposedly make it harder for the attacker to perform any cryptanalysis. Most sources seem to state this is because it will be harder for ...
ioctlvoid's user avatar
  • 425
6 votes
1 answer

Use TPM2.0 to securely decrypt the hard drive in Linux -- unattended

I spent several days trying to figure out how to securely decrypt a hard drive on remote location using TPM2.0 in Linux. I'm no security expert and this is my first battle with TPM2.0. I learned a lot,...
Kamil's user avatar
  • 171
3 votes
1 answer

How can AES-CBC be used for LUKS encryption, when the ciphertext is not static?

In CBC mode of operation, ciphertext from previous block is used as IV in next block. How then can AES-CBC be used for disk encryption (LUKS), when the data on the disk (ie the ciphertext) keeps ...
Martin Vegter's user avatar
2 votes
2 answers

Initialization of a LUKS encrypted partition with cipher or /dev/urandom

I've created a few encrypted devices with LUKS and cryptsetup on Linux and am pretty comfortable with disk encryption in this regard. I've seen it mentioned in many different places that when setting ...
Naftuli Kay's user avatar
  • 6,793
1 vote
3 answers

If I switch to LUKS on an SSD, have I just wiped it?

I have been using an SSD with no system-level encryption. If I now switch to full disk encryption using LUKS + LVM, do I effectively wipe the old data, or is it still hanging around until overwritten?
lofidevops's user avatar
  • 3,610
0 votes
2 answers

LUKS HDD Encryption crack [closed]

I need help. I actually encrypted two mouths ago my external HDD with LUKS but know i have lost my password. I am so depressed because, all of my life is on this HDD. Is there any possibility to get ...
Bernard's user avatar
  • 11