d9fc45de04
Argon2 draft defines suggested parameters for disk encryption use, but LUKS2 approach is slightly different. We need to provide platform independent values. The values in draft expects 64bit systems (suggesting using 6 GiB of RAM), while we need to provide compatibility with all 32bit systems, so allocating more than 4GiB memory is not option for LUKS2. The maximal limit in LUKS2 stays for 4 GiB, and by default LUKS2 PBKDF benchmarking sets maximum to 1 GIB, prefering increase of CPU cost. But for the minimal memory cost we had a quite low limit 32 MiB. This patch increases the bechmarking value to 64 MiB (as minimal suggested values in Argon2 RFC). For compatibility reasons we still allow older limit if set by a parameter.
What the ...?
Cryptsetup is a utility used to conveniently set up disk encryption based on the DMCrypt kernel module.
These include plain dm-crypt volumes, LUKS volumes, loop-AES, TrueCrypt (including VeraCrypt extension) and BitLocker formats.
The project also includes a veritysetup utility used to conveniently setup DMVerity block integrity checking kernel module and integritysetup to setup DMIntegrity block integrity kernel module.
LUKS Design
LUKS is the standard for Linux hard disk encryption. By providing a standard on-disk-format, it does not
only facilitate compatibility among distributions, but also provides secure management of multiple user passwords.
LUKS stores all necessary setup information in the partition header, enabling to transport or migrate data seamlessly.
Last version of the LUKS2 format specification is available here.
Last version of the LUKS1 format specification is available here.
Why LUKS?
- compatibility via standardization,
- secure against low entropy attacks,
- support for multiple keys,
- effective passphrase revocation,
- free.
Project home page.
Frequently asked questions (FAQ)
Download
All release tarballs and release notes are hosted on kernel.org.
The latest stable cryptsetup version is 2.3.6
- cryptsetup-2.3.6.tar.xz
- Signature cryptsetup-2.3.6.tar.sign (You need to decompress file first to check signature.)
- Cryptsetup 2.3.6 Release Notes.
Previous versions
Source and API docs
For development version code, please refer to source page, mirror on kernel.org or GitHub.
For libcryptsetup documentation see libcryptsetup API page.
The libcryptsetup API/ABI changes are tracked in compatibility report.
NLS PO files are maintained by TranslationProject.
Required packages
All distributions provide cryptsetup as distro package. If you need to compile cryptsetup youfself, some packages are required for compilation. Please always prefer distro specific build tools to manually configuring cryptsetup.
Fo available compile options, check configure --help for more info. If you are using a git snapshot, you need to generate configure script with autogen.sh script.
Here is the list of packages needed for the compilation of project for particular distributions:
-
For Fedora:
git gcc make autoconf automake gettext-devel pkgconfig openssl-devel popt-devel device-mapper-devel libuuid-devel json-c-devel libblkid-devel findutils libtool libssh-devel tar. Optionallylibargon2-devel libpwquality-devel. To run internal testsuite you also needsharutils device-mapper jq vim-common expect keyutils netcat shadow-utils openssh-clients openssh sshpass. -
For Debian and Ubuntu:
git gcc make autoconf automake autopoint pkg-config libtool gettext libssl-dev libdevmapper-dev libpopt-dev uuid-dev libsepol1-dev libjson-c-dev libssh-dev libblkid-dev tar. Optionallylibargon2-0-dev libpwquality-dev. To run internal testsuite you also needsharutils dmsetup jq xxd expect keyutils netcat passwd openssh-client sshpass
Note that the list could change as distributions evolve.
Help!
Please always read FAQ first. For cryptsetup and LUKS related questions, please use the dm-crypt mailing list, dm-crypt@saout.de.
If you want to subscribe just send an empty mail to dm-crypt-subscribe@saout.de.
You can also browse list archive or read and search it through web interface on lore.kernel.org or alternatively on marc.info.