Chapter 9. Encrypting block devices using LUKS (2024)

Ciphers

The default cipher used for LUKS is aes-xts-plain64. The default key size for LUKS is 512 bits. The default key size for LUKS with Anaconda XTS mode is 512 bits. The following are the available ciphers:

• Advanced Encryption Standard (AES)
• Twofish
• Serpent

Operations performed by LUKS

• LUKS encrypts entire block devices and is therefore well-suited for protecting contents of mobile devices such as removable storage media or laptop disk drives.
• The underlying contents of the encrypted block device are arbitrary, which makes it useful for encrypting swap devices. This can also be useful with certain databases that use specially formatted block devices for data storage.
• LUKS uses the existing device mapper kernel subsystem.
• LUKS provides passphrase strengthening, which protects against dictionary attacks.
• LUKS devices contain multiple key slots, which means you can add backup keys or passphrases.

Additional resources

• LUKS Project Home Page
• LUKS On-Disk Format Specification
• FIPS 197: Advanced Encryption Standard (AES)

Online re-encryption

The LUKS2 format supports re-encrypting encrypted devices while the devices are in use. For example, you do not have to unmount the file system on the device to perform the following tasks:

• Changing the volume key

• Changing the encryption algorithm

  When encrypting a non-encrypted device, you must still unmount the file system. You can remount the file system after a short initialization of the encryption.

  The LUKS1 format does not support online re-encryption.

Conversion

In certain situations, you can convert LUKS1 to LUKS2. The conversion is not possible specifically in the following scenarios:

• A LUKS1 device is marked as being used by a Policy-Based Decryption (PBD) Clevis solution. The cryptsetup tool does not convert the device when some luksmeta metadata are detected.
• A device is active. The device must be in an inactive state before any conversion is possible.

checksum

The default mode. It balances data protection and performance.

See Also

Configure Data Encryption for Linux DevicesHow To Encrypt A File On Linux? - Scaler Topics10 Best File and Disk Encryption Tools for Linux in 2024Full Disk Encryption From Scratch

This mode stores individual checksums of the sectors in the re-encryption area, which the recovery process can detect for the sectors that were re-encrypted by LUKS2. The mode requires that the block device sector write is atomic.

journal

The safest mode but also the slowest. Since this mode journals the re-encryption area in the binary area, the LUKS2 writes the data twice.

none

The none mode prioritizes performance and provides no data protection. It protects the data only against safe process termination, such as the SIGTERM signal or the user pressing Ctrl+C key. Any unexpected system failure or application failure might result in data corruption.

Automatically

By performing any one of the following actions triggers the automatic recovery action during the next LUKS2 device open action:

• Executing the cryptsetup open command.
• Attaching the device with the systemd-cryptsetup command.

Manually

By using the cryptsetup repair /dev/sdx command on the LUKS2 device.

Additional resources

• cryptsetup-reencrypt(8) and cryptsetup-repair(8) man pages

Prerequisites

• The block device has a file system.

• You have backed up your data.

  Warning

  You might lose your data during the encryption process due to a hardware, kernel, or human failure. Ensure that you have a reliable backup before you start encrypting the data.

Procedure

1. Unmount all file systems on the device that you plan to encrypt, for example:

   # umount /dev/mapper/vg00-lv00

2. Make free space for storing a LUKS header. Use one of the following options that suits your scenario:

   • In the case of encrypting a logical volume, you can extend the logical volume without resizing the file system. For example:

     # lvextend -L+32M /dev/mapper/vg00-lv00

   • Extend the partition by using partition management tools, such as parted.
   • Shrink the file system on the device. You can use the resize2fs utility for the ext2, ext3, or ext4 file systems. Note that you cannot shrink the XFS file system.

3. Initialize the encryption:

   # cryptsetup reencrypt --encrypt --init-only --reduce-device-size 32M /dev/mapper/vg00-lv00 lv00_encrypted/dev/mapper/lv00_encrypted is now active and ready for online encryption.

4. Mount the device:

   # mount /dev/mapper/lv00_encrypted /mnt/lv00_encrypted

5. Add an entry for a persistent mapping to the /etc/crypttab file:

   1. Find the luksUUID:

      # cryptsetup luksUUID /dev/mapper/vg00-lv00a52e2cc9-a5be-47b8-a95d-6bdf4f2d9325

   2. Open /etc/crypttab in a text editor of your choice and add a device in this file:

      $ vi /etc/crypttablv00_encrypted UUID=a52e2cc9-a5be-47b8-a95d-6bdf4f2d9325 none

      Replace a52e2cc9-a5be-47b8-a95d-6bdf4f2d9325 with your device’s luksUUID.

   3. Refresh initramfs with dracut:

      $ dracut -f --regenerate-all

6. Add an entry for a persistent mounting to the /etc/fstab file:

   1. Find the file system’s UUID of the active LUKS block device:

      $ blkid -p /dev/mapper/lv00_encrypted/dev/mapper/lv00-encrypted: UUID="37bc2492-d8fa-4969-9d9b-bb64d3685aa9" BLOCK_SIZE="4096" TYPE="xfs" USAGE="filesystem"

   2. Open /etc/fstab in a text editor of your choice and add a device in this file, for example:

      $ vi /etc/fstabUUID=37bc2492-d8fa-4969-9d9b-bb64d3685aa9 /home auto rw,user,auto 0

      Replace 37bc2492-d8fa-4969-9d9b-bb64d3685aa9 with your file system’s UUID.

7. Resume the online encryption:

   # cryptsetup reencrypt --resume-only /dev/mapper/vg00-lv00Enter passphrase for /dev/mapper/vg00-lv00:Auto-detected active dm device 'lv00_encrypted' for data device /dev/mapper/vg00-lv00.Finished, time 00:31.130, 10272 MiB written, speed 330.0 MiB/s

Verification

1. Verify if the existing data was encrypted:

   # cryptsetup luksDump /dev/mapper/vg00-lv00LUKS header informationVersion: 2Epoch: 4Metadata area: 16384 [bytes]Keyslots area: 16744448 [bytes]UUID: a52e2cc9-a5be-47b8-a95d-6bdf4f2d9325Label: (no label)Subsystem: (no subsystem)Flags: (no flags)Data segments: 0: cryptoffset: 33554432 [bytes]length: (whole device)cipher: aes-xts-plain64[...]

2. View the status of the encrypted blank block device:

   # cryptsetup status lv00_encrypted/dev/mapper/lv00_encrypted is active and is in use. type: LUKS2 cipher: aes-xts-plain64 keysize: 512 bits key location: keyring device: /dev/mapper/vg00-lv00

Additional resources

• cryptsetup(8), cryptsetup-reencrypt(8), lvextend(8), resize2fs(8), and parted(8) man pages

Prerequisites

• The block device has a file system.

• You have backed up your data.

  Warning

  You might lose your data during the encryption process due to a hardware, kernel, or human failure. Ensure that you have a reliable backup before you start encrypting the data.

Procedure

1. Unmount all file systems on the device, for example:

   # umount /dev/nvme0n1p1

2. Initialize the encryption:

   # cryptsetup reencrypt --encrypt --init-only --header /home/header /dev/nvme0n1p1 nvme_encryptedWARNING!========Header file does not exist, do you want to create it?Are you sure? (Type 'yes' in capital letters): YESEnter passphrase for /home/header:Verify passphrase:/dev/mapper/nvme_encrypted is now active and ready for online encryption.

   Replace /home/header with a path to the file with a detached LUKS header. The detached LUKS header has to be accessible to unlock the encrypted device later.

3. Mount the device:

   # mount /dev/mapper/nvme_encrypted /mnt/nvme_encrypted

4. Resume the online encryption:

   # cryptsetup reencrypt --resume-only --header /home/header /dev/nvme0n1p1Enter passphrase for /dev/nvme0n1p1:Auto-detected active dm device 'nvme_encrypted' for data device /dev/nvme0n1p1.Finished, time 00m51s, 10 GiB written, speed 198.2 MiB/s

Verification

1. Verify if the existing data on a block device using LUKS2 with a detached header is encrypted:

   # cryptsetup luksDump /home/headerLUKS header informationVersion: 2Epoch: 88Metadata area: 16384 [bytes]Keyslots area: 16744448 [bytes]UUID: c4f5d274-f4c0-41e3-ac36-22a917ab0386Label: (no label)Subsystem: (no subsystem)Flags: (no flags)Data segments: 0: cryptoffset: 0 [bytes]length: (whole device)cipher: aes-xts-plain64sector: 512 [bytes][...]

2. View the status of the encrypted blank block device:

   # cryptsetup status nvme_encrypted/dev/mapper/nvme_encrypted is active and is in use. type: LUKS2 cipher: aes-xts-plain64 keysize: 512 bits key location: keyring device: /dev/nvme0n1p1

Additional resources

• cryptsetup(8) and cryptsetup-reencrypt(8) man pages

Prerequisites

• A blank block device. You can use commands such as lsblk to find if there is no real data on that device, for example, a file system.

Procedure

1. Setup a partition as an encrypted LUKS partition:

   # cryptsetup luksFormat /dev/nvme0n1p1WARNING!========This will overwrite data on /dev/nvme0n1p1 irrevocably.Are you sure? (Type 'yes' in capital letters): YESEnter passphrase for /dev/nvme0n1p1:Verify passphrase:

2. Open an encrypted LUKS partition:

   # cryptsetup open /dev/nvme0n1p1 nvme0n1p1_encryptedEnter passphrase for /dev/nvme0n1p1:

   This unlocks the partition and maps it to a new device by using the device mapper. To not overwrite the encrypted data, this command alerts the kernel that the device is an encrypted device and addressed through LUKS by using the /dev/mapper/device_mapped_name path.

3. Create a file system to write encrypted data to the partition, which must be accessed through the device mapped name:

   # mkfs -t ext4 /dev/mapper/nvme0n1p1_encrypted

4. Mount the device:

   # mount /dev/mapper/nvme0n1p1_encrypted mount-point

Verification

1. Verify if the blank block device is encrypted:

   # cryptsetup luksDump /dev/nvme0n1p1LUKS header informationVersion: 2Epoch: 3Metadata area: 16384 [bytes]Keyslots area: 16744448 [bytes]UUID: 34ce4870-ffdf-467c-9a9e-345a53ed8a25Label: (no label)Subsystem: (no subsystem)Flags: (no flags)Data segments: 0: cryptoffset: 16777216 [bytes]length: (whole device)cipher: aes-xts-plain64sector: 512 [bytes][...]

2. View the status of the encrypted blank block device:

   # cryptsetup status nvme0n1p1_encrypted/dev/mapper/nvme0n1p1_encrypted is active and is in use. type: LUKS2 cipher: aes-xts-plain64 keysize: 512 bits key location: keyring device: /dev/nvme0n1p1 sector size: 512 offset: 32768 sectors size: 20938752 sectors mode: read/write

Additional resources

• cryptsetup(8), cryptsetup-open (8), and cryptsetup-lusFormat(8) man pages

Prerequisites

• You have installed the RHEL8 web console.

  For instructions, see Installing and enabling the web console.

• The co*ckpit-storaged package is installed on your system.
• Available existing logical volume without encryption.

Procedure

1. Log in to the RHEL8 web console.

   For details, see Logging in to the web console.

2. Click Storage.
3. In the Storage table, click the menu button, ⋮, next to the storage device you want to encrypt.
4. From the drop-down menu, select Format.
5. In the Encryption field, select the encryption specification, LUKS1 or LUKS2.
6. Set and confirm your new passphrase.
7. Optional: Modify further encryption options.
8. Finalize formatting settings.
9. Click Format.

Prerequisites

• You have installed the RHEL8 web console.

  For instructions, see Installing and enabling the web console.

• The co*ckpit-storaged package is installed on your system.

Procedure

1. Log in to the RHEL8 web console.

   For details, see Logging in to the web console.

2. Click Storage
3. In the Storage table, select the disk with encrypted data.

4. On the disk page, scroll to the Keys section and click the edit button.

   

5. In the Change passphrase dialog window:

   1. Enter your current passphrase.
   2. Enter your new passphrase.

   3. Confirm your new passphrase.

      

6. Click Save

Prerequisites

• You have prepared the control node and the managed nodes
• You are logged in to the control node as a user who can run playbooks on the managed nodes.
• The account you use to connect to the managed nodes has sudo permissions on them.

Procedure

1. Create a playbook file, for example ~/playbook.yml, with the following content:

   ---- name: Create and configure a volume encrypted with LUKS hosts: managed-node-01.example.com roles: - rhel-system-roles.storage vars: storage_volumes: - name: barefs type: disk disks: - sdb fs_type: xfs fs_label: label-name mount_point: /mnt/data encryption: true encryption_password: <password>

   You can also add other encryption parameters, such as encryption_key, encryption_cipher, encryption_key_size, and encryption_luks, to the playbook file.

2. Validate the playbook syntax:

   $ ansible-playbook --syntax-check ~/playbook.yml

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

3. Run the playbook:

   $ ansible-playbook ~/playbook.yml

Verification

1. View the encryption status:

   # cryptsetup status sdb/dev/mapper/sdb is active and is in use.type: LUKS2cipher: aes-xts-plain64keysize: 512 bitskey location: keyringdevice: /dev/sdb...

2. Verify the created LUKS encrypted volume:

   # cryptsetup luksDump /dev/sdbVersion: 2Epoch: 6Metadata area: 16384 [bytes]Keyslots area: 33521664 [bytes]UUID: a4c6be82-7347-4a91-a8ad-9479b72c9426Label: (no label)Subsystem: (no subsystem)Flags: allow-discardsData segments: 0: crypt offset: 33554432 [bytes] length: (whole device) cipher: aes-xts-plain64 sector: 4096 [bytes]...

Additional resources

• /usr/share/ansible/roles/rhel-system-roles.storage/README.md file
• /usr/share/doc/rhel-system-roles/storage/ directory
• Encrypting block devices by using LUKS