dm-crypt

TLDR

Create LUKS encrypted volume

$ sudo cryptsetup luksFormat [/dev/sdX]

Open LUKS volume

$ sudo cryptsetup open [/dev/sdX] [name]

Close encrypted volume

$ sudo cryptsetup close [name]

Show LUKS header information

$ sudo cryptsetup luksDump [/dev/sdX]

Add a new key to LUKS volume

$ sudo cryptsetup luksAddKey [/dev/sdX]

Create plain dm-crypt volume

$ sudo cryptsetup open --type plain [/dev/sdX] [name]

Benchmark encryption algorithms

$ cryptsetup benchmark

SYNOPSIS

cryptsetup action [options] device [name]

dm-crypt is the Linux kernel's device-mapper encryption target, providing transparent disk encryption. cryptsetup is the userspace tool to configure dm-crypt, typically using the LUKS (Linux Unified Key Setup) format.
LUKS provides standardized on-disk format with multiple key slots, allowing multiple passphrases or keyfiles. It stores encryption metadata in a header, enabling key management without re-encrypting data.
Plain dm-crypt provides encryption without a header, useful for plausible deniability but requiring exact parameters to be remembered. Both modes create a mapped device in /dev/mapper/ for normal filesystem operations.

PARAMETERS

luksFormat device

Initialize LUKS partition.

open device name

Open and map encrypted device.

close name

Close mapped device.

luksDump device

Display LUKS header information.

luksAddKey device

Add new passphrase/keyfile.

luksRemoveKey device

Remove a passphrase.

luksHeaderBackup device

Backup LUKS header.

luksHeaderRestore device

Restore LUKS header.

--type type

Encryption type: luks, luks2, plain.

--cipher cipher

Encryption cipher (aes-xts-plain64).

--key-size bits

Key size in bits.

--hash hash

Hash for key derivation.

--key-file file

Use keyfile instead of passphrase.

USAGE WORKFLOW

$ # Create encrypted partition
sudo cryptsetup luksFormat /dev/sdb1

# Open and map
sudo cryptsetup open /dev/sdb1 encrypted_data

# Create filesystem
sudo mkfs.ext4 /dev/mapper/encrypted_data

# Mount and use
sudo mount /dev/mapper/encrypted_data /mnt

CAVEATS

LUKS header damage can make data unrecoverable; always backup headers. Encryption has CPU overhead (AES-NI helps significantly). SSDs may require special TRIM considerations. Forgotten passphrases mean permanent data loss.

HISTORY

dm-crypt was merged into the Linux kernel in version 2.6 (2004). LUKS was designed by Clemens Fruhwirth in 2004 to standardize Linux disk encryption. LUKS2, released in 2017, added modern key derivation (Argon2), authenticated encryption, and larger metadata areas.