dm-crypt

dm-crypt

dm-crypt is a transparent disk encryption subsystem in Linux kernel versions 2.6 and later and in DragonFly BSD. It is part of the device mapper infrastructure, and uses cryptographic routines from the kernel's Crypto API. Unlike its predecessor cryptoloop, dm-crypt was designed to support advanced modes of operation, such as XTS, LRW and ESSIV (see disk encryption theory), in order to avoid watermarking attacks.[1] In addition to that, dm-crypt also addresses some reliability problems of cryptoloop.[2]

dm-crypt is implemented as a device mapper target and may be stacked on top of other device mapper transformations. It can thus encrypt whole disks (including removable media), partitions, software RAID volumes, logical volumes, as well as files. It appears as a block device, which can be used to back file systems, swap or an LVM physical volume.

Some Linux distributions support the use of dm-crypt on root file system. These distributions use initrd to prompt the user to enter a passphrase at the console, or insert a smart card prior to the normal boot process.[3]

Contents

Frontends

The dm-crypt device mapper target resides entirely in kernel space, and is only concerned with encryption of the block device — it does not interpret any data itself. It relies on user space front-ends to create and activate encrypted volumes, and manage authentication. At least two frontends are currently available: cryptsetup and cryptmount.

cryptsetup

The "cryptsetup" command-line interface does not write any headers to the encrypted volume, and hence only provides the bare essentials: Encryption settings have to be provided every time the disk is mounted (although usually employed with automated scripts), and only one key can be used per volume; the symmetric encryption key directly derived from the supplied passphrase. For these reasons, the use of cryptsetup is discouraged with plain passphrases.[4] However, the simplicity of cryptsetup makes it useful when combined with third party software, for example, with smart card authentication.

cryptsetup also provides commands to deal with the Linux Unified Key Setup (LUKS) on-disk format. This format provides additional features such as key management and key stretching (using PBKDF2), and remembers encrypted volume configuration across reboots.[3][5]

cryptmount

The "cryptmount" interface is an alternative to the "cryptsetup" tool that allows any user to mount/unmount a dm-crypt file system when needed, without needing superuser privileges after the device has been configured by a superuser.

Features

The fact that disk encryption (volume encryption) software like dm-crypt only deals with transparent encryption of abstract block devices gives it a lot of flexibility. This means that it can be used for encrypting any disk-backed file systems supported by the operating system, as well as swap space. Encrypted volumes can be stored on disk partitions, logical volumes, whole disks as well as file-backed disk images (through the use of loop devices with the losetup utility). It can also be configured to encrypt RAID volumes and LVM physical volumes.

It can also be configured to provide pre-boot authentication through an initrd, thus encrypting all data on the computer (except the bootloader, the kernel and the initrd itself).[3]

When using the cipher block chaining mode of operation with predictable initialization vectors as other disk encryption software, the disk is vulnerable to watermarking attacks. This means that an attacker is able to detect the presence of specially crafted data on the disk. To address this problem in its predecessors, dm-crypt included provisions for more elaborate, disk encryption-specific modes of operation.[1] Support for ESSIV (encrypted salt-sector initialization vector) was introduced in Linux kernel version 2.6.10, LRW in 2.6.20 and XTS in 2.6.24. However, the CBC mode is still the default for compatibility with older volumes.

The Linux Crypto API includes support for most popular block ciphers and hash functions, which are all usable with dm-crypt.

Compatibility

dm-crypt and LUKS encrypted disks can be accessed and used under MS Windows using FreeOTFE, provided that the filesystem used is supported by Windows (e.g. FAT/FAT32/NTFS).

Encrypted Ext2, Ext3 and Ext4 filesystems are supported by use of Ext2Fsd (all ext* versions) or Ext2 Installable File System for Windows (ext2 and ext3 only) and with FreeOTFE

Cryptsetup/LUKS and the required infrastructure have also been implemented on the DragonFly BSD operating system.[6]

See also

References

External links


Wikimedia Foundation. 2010.

Игры ⚽ Нужен реферат?

Look at other dictionaries:

  • Crypt of Civilization — interior contents The Crypt of Civilization is a sealed airtight chamber located at Oglethorpe University in Atlanta, Georgia. The crypt consists of preserved artifacts scheduled to be opened in the year AD 8113.[1] …   Wikipedia

  • Crypt Lake Trail — Crypt Falls The Crypt Lake Trail is one of the premium hikes in Waterton Lakes National Park in Alberta, Canada. It is accessed by a dedicated ferry service operating from the Waterton Park Townsite. The first part of the trail offers the choice… …   Wikipedia

  • Crypt of Medea — Box art Developer(s) Sir Tech Publisher(s) Sir …   Wikipedia

  • Crypt — • The word originally meant a hidden place, natural or artificial, suitable for the concealment of persons or things Catholic Encyclopedia. Kevin Knight. 2006. Crypt     Crypt      …   Catholic encyclopedia

  • crypt — crypt·al; crypt·analysis; crypt·analyst; crypt·analytic; crypt·analytics; crypt·analyze; crypt·ed; crypt·esthesia; crypt; de·crypt; en·crypt; crypt·aesthesia; crypt·esthetic; de·crypt·ment; …   English syllables

  • Crypt (disambiguation) — Crypt may refer to: Crypt, a stone chamber Cryptography Crypt (Unix), both a utility program (command) and an unrelated standard library function in Unix A colloquial short name for Cryptocoryne, a genus of plants Crypt (anatomy) Crypts of… …   Wikipedia

  • Crypt Style — Compilation album by Jon Spencer Blues Explosion Released May 24, 1993 …   Wikipedia

  • Crypt Of Civilization — La Crypt of Civilization (de l anglais signifiant littéralement « crypte de la civilisation »), est une capsule temporelle américaine, fermée en 1936. Considérée par le Livre Guinness des records comme la première à avoir été mise en… …   Wikipédia en Français

  • Crypt of civilization — La Crypt of Civilization (de l anglais signifiant littéralement « crypte de la civilisation »), est une capsule temporelle américaine, fermée en 1936. Considérée par le Livre Guinness des records comme la première à avoir été mise en… …   Wikipédia en Français

  • Crypt Falls — Location Waterton Lakes National Park, Alberta, Canada Type Horsetail …   Wikipedia

  • Crypt of Lyzandred the Mad — Rules required 2nd Ed AD D Campaign setting Greyhawk Authors Sean K. Reynolds First published 1998 …   Wikipedia

Share the article and excerpts

Direct link
Do a right-click on the link above
and select “Copy Link”