Tip: You may want to practise encrypting a virtual hard drive in a virtual machine when learning. If certain AES ciphers excel with a considerable higher throughput, these are probably the ones with hardware support in the CPU.

Since changing an encryption cipher of a block device after setup is difficult, it is important to check dm-crypt performance for the individual parameters in advance:Ĭan give guidance on deciding for an algorithm and key-size prior to installation. Block device encryption is fast, but speed matters a lot too. Since different parameters are required or optional, depending on encryption mode and action, the following sections point out differences further. A full list of options can be found on the man page. Which lists options, actions and the default parameters for the encryption modes in that order. It has compiled-in defaults for the options and the encryption mode, which will be used if no others are specified on the command line. # cryptsetup OPTIONS action action-specific-options device dmname For further information see Data-at-rest encryption#Block device encryption.

Devices accessed via the device-mapper are called block devices. The most notable expansion was for the Linux Unified Key Setup (LUKS) extension, which stores all of the needed setup information for dm-crypt on the disk itself and abstracts partition and key management in an attempt to improve ease of use. The tool was later expanded to support different encryption types that rely on the Linux kernel device- mapper and the cryptographic modules. This section covers how to manually utilize dm-crypt from the command line to encrypt a system.īefore using cryptsetup, always make sure the dm_crypt kernel module is loaded.Ĭryptsetup is the command line tool to interface with dm-crypt for creating, accessing and managing encrypted devices.

Truecrypt 7.2 create volume