cryptsetup(8)
cryptsetup manages LUKS encrypted volumes and dm-crypt device mappings on Linux.
Synopsis
cryptsetup [OPTIONS] <command> [command_options] <device> [arguments]Description
cryptsetup is the main tool for setting up and managing encrypted block devices using LUKS (Linux Unified Key Setup) and plain dm-crypt encryption. It handles creating encrypted volumes, opening them for use, closing them, and managing passphrases and key slots.
LUKS is the standard encryption format for Linux, storing metadata that allows multiple passphrases to unlock the same encrypted data. Plain dm-crypt mode offers encryption without this metadata layer.
Common options
| Flag | What it does |
|---|---|
--type luks|plain | Specify encryption type: luks (default, recommended) or plain dm-crypt |
-c, --cipher | Set cipher algorithm and mode, e.g. aes-xts-plain64 |
-s, --key-size | Key size in bits (256, 512, etc.; default 256 for aes-xts) |
-h, --hash | Hash algorithm for key derivation (sha256, sha512, etc.) |
--pbkdf | Key derivation function: pbkdf2, argon2i, or argon2id |
-i, --iter-time | PBKDF iteration time in milliseconds (default 2000) |
--use-random, --use-urandom | Use /dev/random or /dev/urandom for key material generation |
-y, --verify-passphrase | Prompt twice for passphrase to confirm it was entered correctly |
-d, --key-file | Read key from file instead of prompting interactively |
-q, --quiet | Suppress informational messages |
--allow-discards | Allow TRIM/discard requests on encrypted device (weaker security) |
-v, --verbose | Show detailed progress and debug information |
Examples
Initialize /dev/sda3 as a new LUKS encrypted volume, prompting for a passphrase
cryptsetup luksFormat /dev/sda3Format with AES-XTS cipher and 512-bit key for stronger encryption
cryptsetup luksFormat -c aes-xts-plain64 -s 512 /dev/sda3Unlock the encrypted volume and map it to /dev/mapper/mycrypt; prompts for passphrase
cryptsetup open /dev/sda3 mycryptOpen encrypted device using a key file instead of interactive passphrase
cryptsetup open -d /root/keyfile /dev/sda3 mycryptLock and close the encrypted volume, making it inaccessible
cryptsetup close mycryptAdd a new passphrase to the volume; requires an existing passphrase first
cryptsetup luksAddKey /dev/sda3Display LUKS metadata and key slot information for the encrypted device
cryptsetup luksDump /dev/sda3Create a plain dm-crypt mapping without LUKS metadata (legacy mode)
cryptsetup create --cipher aes-xts-plain64 plainvol /dev/sda2