Dm-crypt

dm-crypt is a disk encryption system using the kernels crypto API framework and device mapper. dm-crypt is cappable of encrypting whole disks, logical volumes, single files and RAID volumes.

Kernel Configuration
To use dm-crypt the certain kernel modules must be built such as any hashing functions or stream ciphers that are to be used to encrypt the volume, a file system that is to be applied to the encrypted volume such as ext3, loopback device support and initrd support. For a basic configuration SHA256 and MD5 hashes are generally built into the kernel by default along with the AES cipher, if different alogrithms are required these can be found under the Cryptographic API section. This is an example of a basic kernel configuration.

Most of the gentoo install media will have the basic modules built in by default, however more custom modules such as Whirlpool hashes are not included, but can easily be built then loaded.

Configuring Encrypted Volume
For this example the volume will be a plain partition (/dev/sda1)


 * Load kernel modules appropriate to your setup


 * Generate key


 * Fill volume with random bits/shred (optional)

or

For keyFile based auth
 * cryptsetup luksFormat

For password based auth

For keyFile based auth
 * cryptsetup open

For password based auth


 * mkfs, using ext4 in this case


 * mount

Initrd Config For Wholedisk Encryption
The easiest option for booting an encrypted root partition is to use dracut, dracut is a flexible modular initramfs infrastructure and aims to have as little as possible hard-coded into the initramfs. To configure dracut for dm-crypt make sure to include the dracut crypt module.

External resources

 * homepage