DM-CRYPT info

Introduction

dmcrypt is a way of encrypting and decrypting files using a cryptographic cipher. dmcrypt allows you to access these files like a normal block device, dmcrypt is designed to be put on a block device but with a loopback device we can easily avoid the need for a separate partition.

There are other ways to encrypt files such as Cryptoloop (deprecated, less secure and uncleanly coded) or loopaes (more secure and faster, but harder to use)

Security Issue

As for every other hard drive encryption mechanism, the encryption key is stored in RAM to allow dm-crypt to encrypt/decrypt the data. Therefore the security of the key relies on the security of the RAM.

Recently some researchers have found that, under certain conditions, it is possible to retrieve this key, even if the system is shutdown.

See: http://citp.princeton.edu/memory/

A work around would be to always shut-down your system properly, and stay around for a while to ensure that nobody is playing with your computer. For the more paranoid ones, you can also take the RAM on your pocket, making the key effectively inaccessible.

You have to remember that hard-drive encryption is only effective when the corresponding partition is unmounted. An encrypted partition which is always mounted is as secure as a clear partition, as one may access each of them the same way.

Loopback or partition?

A loopback means that you have a file that is on a partition that you then mount using a special device called a loopback. The loop device then acts as a normal block device transforming your file into just another hard disk :)

This is useful if for example you wish to store all your ssh keys safely but don't want to have to make another partition for it!

Configuring your kernel for dmcrypt

You must configure your kernel to be able to use dmcrypt. Use your favourite kernel or emerge development-sources.

cd /usr/src/linux
make menuconfig

You must first enable the device mapper (dm):

Linux Kernel Configuration: Device Mapper

Device Drivers --> [*] Multiple devices driver support (RAID and LVM) <*> Device mapper support <*> Crypt target support Then you must enable the cipher (aes): Cryptographic API --> <*> AES cipher algorithims (i586) If you're going to be using dmcrypt on a loopback file, not a partition: Device Drivers --> Block Devices --> <*> Loopback device support # Remember, cryptoloop is not dmcrypt

If you wish you may enable all of the above as modules, but you must then modprobe them.

Now compile your kernel:

 make && make modules_install

Now inform your bootloader of this change and reboot (or if you compiled them all as a module and do it right you can just modprobe)

Installing the tools needed

emerge sys-fs/cryptsetup