Dm-crypt

dm-crypt is a disk encryption system using the kernels crypto API framework and device mapper. dm-crypt is cappable of encrypting whole disks, logical volumes, single files and RAID volumes.

Kernel Configuration
To use dm-crypt the certain kernel options must be built-in such as any hashing functions or stream ciphers that are to be used to encrypt the volume, a filesystem that is to be applied to the encrypted volume such as ext4, loopback device support and initramfs support. For a basic configuration SHA256 and MD5 hashes are generally built into the kernel by default along with the AES cipher, if different alogrithms are required these can be found under the Cryptographic API section. This is an example of a basic kernel configuration.

Most of the Gentoo install media will have the basic modules built in by default, however more custom modules such as Whirlpool hashes are not included, but can easily be built then loaded.

Emerging cryptsetup
In order to handle the encrypted partitions, you will need to emerge sys-fs/cryptsetup if it is not yet installed:

Configuring Encrypted Volume
For this example the volume will be a plain partition.


 * Load kernel modules appropriate to your setup


 * Generate key




 * Fill volume with random bits/shred (optional)
 * or
 * or


 * cryptsetup luksFormat
 * For keyFile based auth


 * For password based auth


 * cryptsetup open
 * For keyFile based auth


 * For password based auth


 * mkfs, using ext4 in this case


 * mount

Initrd config For Wholedisk Encryption
The easiest option for booting an encrypted root partition is to use dracut. To configure dracut for dm-crypt make sure to include the crypt module. Follow the dracut article making sure to include the crypt module along with any others required: