Linux Examples: dm-crypt
This section gives a series of examples of how to create Linux dm-crypt volumes, and then mount them using FreeOTFE.
To begin using dm-crypt under Linux, ensure that the various kernel modules are installed:
modprobe cryptoloop
modprobe deflate modprobe zlib_deflate modprobe twofish modprobe serpent modprobe aes_i586 modprobe blowfish modprobe des modprobe sha256 modprobe sha512 modprobe crypto_null modprobe md5 modprobe md4 modprobe cast5 modprobe cast6 modprobe arc4 modprobe khazad modprobe anubis
modprobe dm_mod (this should give you dm_snapshot, dm_zero and dm_mirror?) modprobe dm_crypt
At this point, typing "dmsetup targets" should give you something along the lines of:
crypt v1.0.0 striped v1.0.1 linear v1.0.1 error v1.0.1
Typing "lsmod" will show you which modules are currently installed.
The examples shown below may then be followed to create and use various volume files.
Note: If not overridden by the user, dm-crypt defaults to encrypting with:
Cypher:
|
AES
|
Cypher keysize:
|
256 bit
|
User key processed with:
|
RIPEMD-160 (not "RIPEMD-160 (Linux; Twice, with A)")
"Hash with "A"s, if hash output is too short" option - selected
|
IV generation:
|
32 bit sector ID |
This document gives the follow examples:
Note: These examples have been
tested using Fedora Core 3, with a v2.6.11.7 kernel installed; though
they should work for all compatable Linux distributions.
Example #1: Mounting a dm-crypt Volume Using dm-crypt's Default Encryption
This example demonstrates use of a dm-crypt volume using the dm-crypt's
default encryption system: AES128 with the user's password hashed with
RIPEMD160, using the 32 bit sector IDs as encryption IVs
Creating the volume file under Linux:
dd if=/dev/zero of=./volumes/vol_default.vol bs=1K count=100 losetup /dev/loop0 ./volumes/vol_default.vol echo password1234567890ABC | cryptsetup create myMapper /dev/loop0 dmsetup ls dmsetup table dmsetup status losetup /dev/loop1 /dev/mapper/myMapper mkdosfs /dev/loop1 mkdir ./test_mountpoint mount /dev/loop1 ./test_mountpoint cp ./test_files/SHORT_TEXT.txt ./test_mountpoint cp ./test_files/BINARY_ZEROS.dat ./test_mountpoint cp ./test_files/BINARY_ABC_RPTD.dat ./test_mountpoint cp ./test_files/BINARY_00_FF_RPTD.dat ./test_mountpoint umount ./test_mountpoint losetup -d /dev/loop1 cryptsetup remove myMapper losetup -d /dev/loop0 rm -rf ./test_mountpoint
Mounting the volume under FreeOTFE:
- Select "Linux | Mount..."
- Select the volume file
- "Key" tab:
- Enter "password1234567890ABC" as the key
- Leave GPG executable blank
- Leave GPG keyfile blank
- Leave seed blank
- Select the "RIPEMD-160 (160/512)" hash
- Ensure "Hash with "A"s, if hash output is too short" is checked.
- Leave iteration count at 0
- "Encryption" tab:
- Select the "AES (CBC; 256/128)" cypher
- Select "32 bit sector ID" as the IV generation method
- Set "Sector zero location" to "Start of encrypted data"
- "File options" tab:
- Leave offset at 0
- Leave sizelimit at 0
- "Mount options" tab:
- Select any unused drive letter
- Leave readonly unchecked
- Click the "OK" button
Example #2: Mounting a dm-crypt Volume Using 128 bit AES Encryption
This example demonstrates use of a dm-crypt AES128 volume.
Creating the volume file under Linux:
dd if=/dev/zero of=./volumes/vol_aes128.vol bs=1K count=100 losetup /dev/loop0 ./volumes/vol_aes128.vol echo password1234567890ABC | cryptsetup -c aes -s 128 create myMapper /dev/loop0 dmsetup ls dmsetup table dmsetup status losetup /dev/loop1 /dev/mapper/myMapper mkdosfs /dev/loop1 mkdir ./test_mountpoint mount /dev/loop1 ./test_mountpoint cp ./test_files/SHORT_TEXT.txt ./test_mountpoint cp ./test_files/BINARY_ZEROS.dat ./test_mountpoint cp ./test_files/BINARY_ABC_RPTD.dat ./test_mountpoint cp ./test_files/BINARY_00_FF_RPTD.dat ./test_mountpoint umount ./test_mountpoint losetup -d /dev/loop1 cryptsetup remove myMapper losetup -d /dev/loop0 rm -rf ./test_mountpoint
Mounting the volume under FreeOTFE:
- Select "Linux | Mount..."
- Select the volume file
- "Key" tab:
- Enter "password1234567890ABC" as the key
- Leave GPG executable blank
- Leave GPG keyfile blank
- Leave seed blank
- Select the "RIPEMD-160 (160/512)" hash.
- Ensure "Hash with "A"s, if hash output is too short" is checked.
- Leave iteration count at 0
- "Encryption" tab:
- Select the "AES (CBC; 128/128)" cypher
- Select "32 bit sector ID" as the IV generation method
- Set "Sector zero location" to "Start of encrypted data"
- "File options" tab:
- Leave offset at 0
- Leave sizelimit at 0
- "Mount options" tab:
- Select any unused drive letter
- Leave readonly unchecked
- Click the "OK" button
Example #3: Mounting a dm-crypt Volume Using 256 bit AES Encryption, using SHA256 ESSIV
This example demonstrates use of a dm-crypt AES256 volume using SHA-256 ESSIV sector IVs.
Creating the volume file under Linux:
dd if=/dev/zero of=./volumes/vol_aes_essiv_sha256.vol bs=1K count=100 losetup /dev/loop0 ./volumes/vol_aes_essiv_sha256.vol echo password1234567890ABC | cryptsetup -c aes-cbc-essiv:sha256 create myMapper /dev/loop0 dmsetup ls dmsetup table dmsetup status losetup /dev/loop1 /dev/mapper/myMapper mkdosfs /dev/loop1 mkdir ./test_mountpoint mount /dev/loop1 ./test_mountpoint cp ./test_files/SHORT_TEXT.txt ./test_mountpoint cp ./test_files/BINARY_ZEROS.dat ./test_mountpoint cp ./test_files/BINARY_ABC_RPTD.dat ./test_mountpoint cp ./test_files/BINARY_00_FF_RPTD.dat ./test_mountpoint umount ./test_mountpoint losetup -d /dev/loop1 cryptsetup remove myMapper losetup -d /dev/loop0 rm -rf ./test_mountpoint
Mounting the volume under FreeOTFE:
- Select "Linux | Mount..."
- Select the volume file
- "Key" tab:
- Enter "password1234567890ABC" as the key
- Leave GPG executable blank
- Leave GPG keyfile blank
- Leave seed blank
- Select the "RIPEMD-160 (160/512)" hash
- Ensure "Hash with "A"s, if hash output is too short" is checked.
- Leave iteration count at 0
- "Encryption" tab:
- Select the "AES (CBC; 256/128)" cypher
- Select "ESSIV" as the IV generation method
- Set "Sector zero location" to "Start of encrypted data"
- Select "SHA-256 (256/512)" as the IV hash
- Select "AES (CBC; 256/128)" as the IV cypher
- "File options" tab:
- Leave offset at 0
- Leave sizelimit at 0
- "Mount options" tab:
- Select any unused drive letter
- Leave readonly unchecked
- Click the "OK" button
Example #4: Mounting a dm-crypt Volume Using 448 bit Blowfish Encryption
This example demonstrates use of a dm-crypt Blowfish 448 volume.
Creating the volume file under Linux:
dd if=/dev/zero of=./volumes/vol_blowfish_448.vol bs=1K count=100 losetup /dev/loop0 ./volumes/vol_blowfish_448.vol echo password1234567890ABC | cryptsetup -c blowfish -s 448 create myMapper /dev/loop0 dmsetup ls dmsetup table dmsetup status losetup /dev/loop1 /dev/mapper/myMapper mkdosfs /dev/loop1 mkdir ./test_mountpoint mount /dev/loop1 ./test_mountpoint cp ./test_files/SHORT_TEXT.txt ./test_mountpoint cp ./test_files/BINARY_ZEROS.dat ./test_mountpoint cp ./test_files/BINARY_ABC_RPTD.dat ./test_mountpoint cp ./test_files/BINARY_00_FF_RPTD.dat ./test_mountpoint umount ./test_mountpoint losetup -d /dev/loop1 cryptsetup remove myMapper losetup -d /dev/loop0 rm -rf ./test_mountpoint
Mounting the volume under FreeOTFE:
- Select "Linux | Mount..."
- Select the volume file
- "Key" tab:
- Enter "password1234567890ABC" as the key
- Leave GPG executable blank
- Leave GPG keyfile blank
- Leave seed blank
- Select the "RIPEMD-160 (160/512)" hash
- Ensure "Hash with "A"s, if hash output is too short" is checked.
- Leave iteration count at 0
- "Encryption" tab:
- Select the "Blowfish (CBC; 448/64)" cypher
- Select "32 bit sector ID" as the IV generation method
- Set "Sector zero location" to "Start of encrypted data"
- "File options" tab:
- Leave offset at 0
- Leave sizelimit at 0
- "Mount options" tab:
- Select any unused drive letter
- Leave readonly unchecked
- Click the "OK" button
Example #5: Mounting a dm-crypt Volume Using 256 bit Twofish and Offset
This example demonstrates use of a dm-crypt Twofish 256 volume, with the
encrypted volume beginning at an offset of 3 sectors (3 x 512 = 1536 bytes) into the volume
file.
Creating the volume file under Linux:
dd if=/dev/zero of=./volumes/vol_twofish_o3.vol bs=1K count=100 losetup /dev/loop0 ./volumes/vol_twofish_o3.vol echo password1234567890ABC | cryptsetup -c twofish -o 3 create myMapper /dev/loop0 dmsetup ls dmsetup table dmsetup status losetup /dev/loop1 /dev/mapper/myMapper mkdosfs /dev/loop1 mkdir ./test_mountpoint mount /dev/loop1 ./test_mountpoint cp ./test_files/SHORT_TEXT.txt ./test_mountpoint cp ./test_files/BINARY_ZEROS.dat ./test_mountpoint cp ./test_files/BINARY_ABC_RPTD.dat ./test_mountpoint cp ./test_files/BINARY_00_FF_RPTD.dat ./test_mountpoint umount ./test_mountpoint losetup -d /dev/loop1 cryptsetup remove myMapper losetup -d /dev/loop0 rm -rf ./test_mountpoint
Mounting the volume under FreeOTFE:
- Select "Linux | Mount..."
- Select the volume file
- "Key" tab:
- Enter "password1234567890ABC" as the key
- Leave GPG executable blank
- Leave GPG keyfile blank
- Leave seed blank
- Select the "RIPEMD-160 (160/512)" hash
- Ensure "Hash with "A"s, if hash output is too short" is checked.
- Leave iteration count at 0
- "Encryption" tab:
- Select the "Twofish (CBC; 256/128)" cypher
- Select "32 bit sector ID" as the IV generation method
- Set "Sector zero location" to "Start of encrypted data"
- "File options" tab:
- Set offset to 1536 bytes (i.e. 3 sectors, each of 512 bytes)
- Leave sizelimit at 0
- "Mount options" tab:
- Select any unused drive letter
- Leave readonly unchecked
- Click the "OK" button
Example #6: Mounting a dm-crypt Volume Using 256 bit AES Encryption, with MD5 Password Hashing
This example demonstrates use of a dm-crypt Twofish 256 volume, with the
user's password processed with MD5.
Creating the volume file under Linux:
dd if=/dev/zero of=./volumes/vol_aes_md5.vol bs=1K count=100 losetup /dev/loop0 ./volumes/vol_aes_md5.vol echo password1234567890ABC | cryptsetup -c aes -h md5 create myMapper /dev/loop0 dmsetup ls dmsetup table dmsetup status losetup /dev/loop1 /dev/mapper/myMapper mkdosfs /dev/loop1 mkdir ./test_mountpoint mount /dev/loop1 ./test_mountpoint cp ./test_files/SHORT_TEXT.txt ./test_mountpoint cp ./test_files/BINARY_ZEROS.dat ./test_mountpoint cp ./test_files/BINARY_ABC_RPTD.dat ./test_mountpoint cp ./test_files/BINARY_00_FF_RPTD.dat ./test_mountpoint umount ./test_mountpoint losetup -d /dev/loop1 cryptsetup remove myMapper losetup -d /dev/loop0 rm -rf ./test_mountpoint
Mounting the volume under FreeOTFE:
- Select "Linux | Mount..."
- Select the volume file
- "Key" tab:
- Enter "password1234567890ABC" as the key
- Leave GPG executable blank
- Leave GPG keyfile blank
- Leave seed blank
- Select the "MD5 (128/512)" hash
- Ensure "Hash with "A"s, if hash output is too short" is checked.
- Leave iteration count at 0
- "Encryption" tab:
- Select the "AES (CBC; 256/128)" cypher
- Select "32 bit sector ID" as the IV generation method
- Set "Sector zero location" to "Start of encrypted data"
- "File options" tab:
- Leave offset at 0
- Leave sizelimit at 0
- "Mount options" tab:
- Select any unused drive letter
- Leave readonly unchecked
- Click the "OK" button
Example #7: Mounting a dm-crypt Volume Using 448 bit Blowfish Encryption, MD5 Password Hashing, and SHA-256 ESSIV
This example demonstrates use of a dm-crypt Blowfish 448 volume, with the
user's password processed with MD5 and ESSIV using SHA-256.
Note that although the main cypher is Blowfish 448, Blowfish 256 is used as the IV cypher as the IV hash outputs 256 bytes
Creating the volume file under Linux:
dd if=/dev/zero of=./volumes/vol_blowfish_448_essivsha256_md5.vol bs=1K count=100 losetup /dev/loop0 ./volumes/vol_blowfish_448_essivsha256_md5.vol echo password1234567890ABC | cryptsetup -c blowfish-cbc-essiv:sha256 -s 448 -h md5 create myMapper /dev/loop0 dmsetup ls dmsetup table dmsetup status losetup /dev/loop1 /dev/mapper/myMapper mkdosfs /dev/loop1 mkdir ./test_mountpoint mount /dev/loop1 ./test_mountpoint cp ./test_files/SHORT_TEXT.txt ./test_mountpoint cp ./test_files/BINARY_ZEROS.dat ./test_mountpoint cp ./test_files/BINARY_ABC_RPTD.dat ./test_mountpoint cp ./test_files/BINARY_00_FF_RPTD.dat ./test_mountpoint umount ./test_mountpoint losetup -d /dev/loop1 cryptsetup remove myMapper losetup -d /dev/loop0 rm -rf ./test_mountpoint
Mounting the volume under FreeOTFE:
- Select "Linux | Mount..."
- Select the volume file
- "Key" tab:
- Enter "password1234567890ABC" as the key
- Leave GPG executable blank
- Leave GPG keyfile blank
- Leave seed blank
- Select the "MD5 (128/512)" hash
- Ensure "Hash with "A"s, if hash output is too short" is checked.
- Leave iteration count at 0
- "Encryption" tab:
- Select the "Blowfish (CBC; 448/64)" cypher
- Select "ESSIV" as the IV generation method
- Set "Sector zero location" to "Start of encrypted data"
- Select "SHA-256 (256/512)" as the IV hash
- Select "Blowfish (CBC; 256/64)" as the IV cypher
- "File options" tab:
- Leave offset at 0
- Leave sizelimit at 0
- "Mount options" tab:
- Select any unused drive letter
- Leave readonly unchecked
- Click the "OK" button
|