Linux Examples: LUKS

This section gives a series of examples of how to create Linux LUKS volumes, and then mount them using FreeOTFE.

To begin using LUKS under Linux, ensure that the various kernel modules are installed:
modprobe cryptoloop

modprobe aes
modprobe anubis
modprobe arc4
modprobe blkcipher
modprobe blowfish
modprobe cast5
modprobe cast6
modprobe cbc
modprobe crc32c
modprobe crypto_algapi
modprobe crypto_hash
modprobe cryptomgr
modprobe crypto_null
modprobe deflate
modprobe des
modprobe ecb
modprobe gf128mul
modprobe hmac
modprobe khazad
modprobe lrw
modprobe md4
modprobe md5
modprobe michael_mic
modprobe serpent
modprobe sha1
modprobe sha256
modprobe sha512
modprobe tea
modprobe tgr192
modprobe twofish_common
modprobe twofish
modprobe wp512
modprobe xcbc

# dm_mod should give you dm_snapshot, dm_zero and dm_mirror?
modprobe dm_mod
modprobe dm_crypt
At this point, typing "dmsetup targets" should give you something along the lines of:
crypt            v1.0.0
striped          v1.0.1
linear           v1.0.1
error            v1.0.1
Typing "lsmod" will show you which modules are currently installed.
The examples shown below may then be followed to create and use various volume files.

Note: If not overridden by the user, LUKS defaults to encrypting with:

Cypher:
AES
Cypher keysize:
128 bit
Cypher mode:
cbc-plain
Hash:
SHA-1

This document gives the follow examples:
Note: These examples have been tested using Fedora Core 3, with a v2.6.20.1 kernel installed and using cryptsetup-luks v1.0; though they should work for all compatible Linux distributions.
Note: The executable name in the following examples is "cryptsetup-luks"; most systems use "cryptsetup".

Example #1: Mounting a LUKS Volume Using LUKS's Default Encryption

This example demonstrates use of a LUKS volume using the LUKS's default encryption system: AES128 with the user's password hashed with SHA1, using 32 bit sector IDs as encryption IVs

Creating the volume file under Linux:
dd if=/dev/zero of=./volumes/vol_default.vol bs=1M count=1
losetup /dev/loop0 ./volumes/vol_default.vol
echo password1234567890ABC | cryptsetup-luks luksFormat /dev/loop0
cryptsetup-luks luksDump /dev/loop0
echo password1234567890ABC | cryptsetup-luks luksOpen /dev/loop0 myMapper
dmsetup ls
dmsetup table
dmsetup status
cryptsetup-luks status myMapper
losetup /dev/loop1 /dev/mapper/myMapper
mkdosfs /dev/loop1
mkdir ./test_mountpoint
mount /dev/loop1 ./test_mountpoint
cp ./test_files/SHORT_TEXT.txt ./test_mountpoint
cp ./test_files/BINARY_ZEROS.dat ./test_mountpoint
cp ./test_files/BINARY_ABC_RPTD.dat ./test_mountpoint
cp ./test_files/BINARY_00_FF_RPTD.dat ./test_mountpoint
umount ./test_mountpoint
losetup -d /dev/loop1
cryptsetup-luks luksClose myMapper
losetup -d /dev/loop0
rm -rf ./test_mountpoint
Mounting the volume under FreeOTFE:
  1. Select "Linux | Mount..."
  2. Select the volume file
  3. In the dialog shown, enter "password1234567890ABC" as the key, and set any of the options wanted.
  4. Click the "OK" button


Example #2: Mounting a LUKS Volume Using 256 bit AES Encryption

This example demonstrates use of a LUKS AES256 volume.

Creating the volume file under Linux:
dd if=/dev/zero of=./volumes/vol_aes_256.vol bs=1M count=1
losetup /dev/loop0 ./volumes/vol_aes_256.vol
echo password1234567890ABC | cryptsetup-luks -c aes -s 256 luksFormat /dev/loop0
cryptsetup-luks luksDump /dev/loop0
echo password1234567890ABC | cryptsetup-luks luksOpen /dev/loop0 myMapper
dmsetup ls
dmsetup table
dmsetup status
cryptsetup-luks status myMapper
losetup /dev/loop1 /dev/mapper/myMapper
mkdosfs /dev/loop1
mkdir ./test_mountpoint
mount /dev/loop1 ./test_mountpoint
cp ./test_files/SHORT_TEXT.txt ./test_mountpoint
cp ./test_files/BINARY_ZEROS.dat ./test_mountpoint
cp ./test_files/BINARY_ABC_RPTD.dat ./test_mountpoint
cp ./test_files/BINARY_00_FF_RPTD.dat ./test_mountpoint
umount ./test_mountpoint
losetup -d /dev/loop1
cryptsetup-luks luksClose myMapper
losetup -d /dev/loop0
rm -rf ./test_mountpoint
Mounting the volume under FreeOTFE:
  1. Select "Linux | Mount..."
  2. Select the losetup volume file
  3. In the dialog shown, enter "password1234567890ABC" as the key, and set any of the options wanted.
  4. Click the "OK" button


Example #3: Mounting a LUKS Volume Using 128 bit Twofish Encryption

This example demonstrates use of a LUKS Twofish 128 volume.

Creating the volume file under Linux:
dd if=/dev/zero of=./volumes/vol_twofish.vol bs=1M count=1
losetup /dev/loop0 ./volumes/vol_twofish.vol
echo password1234567890ABC | cryptsetup-luks -c twofish luksFormat /dev/loop0
cryptsetup-luks luksDump /dev/loop0
echo password1234567890ABC | cryptsetup-luks luksOpen /dev/loop0 myMapper
dmsetup ls
dmsetup table
dmsetup status
cryptsetup-luks status myMapper
losetup /dev/loop1 /dev/mapper/myMapper
#cat ./test_files/2MB_Z.dat > /dev/loop1
#cat ./test_files/2MB_0x00.dat > /dev/loop1
mkdosfs /dev/loop1
mkdir ./test_mountpoint
mount /dev/loop1 ./test_mountpoint
cp ./test_files/SHORT_TEXT.txt ./test_mountpoint
cp ./test_files/BINARY_ZEROS.dat ./test_mountpoint
cp ./test_files/BINARY_ABC_RPTD.dat ./test_mountpoint
cp ./test_files/BINARY_00_FF_RPTD.dat ./test_mountpoint
umount ./test_mountpoint
losetup -d /dev/loop1
cryptsetup-luks luksClose myMapper
losetup -d /dev/loop0
rm -rf ./test_mountpoint
Mounting the volume under FreeOTFE:
  1. Select "Linux | Mount..."
  2. Select the losetup volume file
  3. In the dialog shown, enter "password1234567890ABC" as the key, and set any of the options wanted.
  4. Click the "OK" button