source: postlfs/security/cryptsetup.xml

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
   "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
  <!ENTITY % general-entities SYSTEM "../../general.ent">
  %general-entities;

  <!ENTITY cryptsetup-download-http "&kernel-dl;/linux/utils/cryptsetup/v&cryptsetup-minor;/cryptsetup-&cryptsetup-version;.tar.xz">
  <!ENTITY cryptsetup-download-ftp  " ">
  <!ENTITY cryptsetup-md5sum        "d13fa531c37f05824d67ae92f3c6f73b">
  <!ENTITY cryptsetup-size          "11 MB">
  <!ENTITY cryptsetup-buildsize     "32 MB (add 5 MB for tests)">
  <!ENTITY cryptsetup-time          "0.2 SBU (add 8.1 SBU for tests)">
]>

<sect1 id="cryptsetup" xreflabel="cryptsetup-&cryptsetup-version;">
  <?dbhtml filename="cryptsetup.html"?>


  <title>cryptsetup-&cryptsetup-version;</title>

  <indexterm zone="cryptsetup">
    <primary sortas="a-cryptsetup">cryptsetup</primary>
  </indexterm>

  <sect2 role="package">
    <title>Introduction to cryptsetup</title>

    <para>
      cryptsetup is used to set up transparent encryption of block devices
      using the kernel crypto API.
    </para>

    &lfs121_checked;

    <bridgehead renderas="sect3">Package Information</bridgehead>
    <itemizedlist spacing="compact">
      <listitem>
        <para>
          Download (HTTP): <ulink url="&cryptsetup-download-http;"/>
        </para>
      </listitem>
      <listitem>
        <para>
          Download (FTP): <ulink url="&cryptsetup-download-ftp;"/>
        </para>
      </listitem>
      <listitem>
        <para>
          Download MD5 sum: &cryptsetup-md5sum;
        </para>
      </listitem>
      <listitem>
        <para>
          Download size: &cryptsetup-size;
        </para>
      </listitem>
      <listitem>
        <para>
          Estimated disk space required: &cryptsetup-buildsize;
        </para>
      </listitem>
      <listitem>
        <para>
          Estimated build time: &cryptsetup-time;
        </para>
      </listitem>
    </itemizedlist>

<!-- No longer needed with 2.3.2.
    <bridgehead renderas="sect3">Additional Downloads</bridgehead>
    <itemizedlist spacing="compact">
      <listitem>
        <para>
          Required patch:
          <ulink url="&patch-root;/cryptsetup-&cryptsetup-version;-upstream_fixes-1.patch"/>
        </para>
      </listitem>
    </itemizedlist>
-->

    <bridgehead renderas="sect3">cryptsetup Dependencies</bridgehead>

    <bridgehead renderas="sect4">Required</bridgehead>
    <para role="required">
      <xref linkend="json-c"/>,
      <xref linkend="lvm2"/>, and
      <xref linkend="popt"/>
    </para>

    <bridgehead renderas="sect4">Optional</bridgehead>
    <para role="optional">
      <xref linkend="asciidoctor"/>,
      <xref linkend="libpwquality"/>,
      <ulink url="https://github.com/P-H-C/phc-winner-argon2">argon2</ulink>,
      <ulink url="https://www.libssh.org/">libssh</ulink>, and
      <ulink url="https://www.openwall.com/passwdqc/">passwdqc</ulink>
    </para>


  </sect2>

  <sect2 role="kernel" id="cryptsetup-kernel">
    <title>Kernel Configuration</title>

    <para>
      Encrypted block devices require kernel support.  To use it, the
      appropriate kernel configuration parameters need to be set:
    </para>

    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
      href="cryptsetup-kernel.xml"/>

    <indexterm zone="cryptsetup cryptsetup-kernel">
      <primary sortas="d-cryptsetup">cryptsetup</primary>
    </indexterm>

  </sect2>

    <sect2 role="installation">
      <title>Installation of cryptsetup</title>

    <para>
      Install <application>cryptsetup</application> by running the following
      commands:
    </para>

<screen><userinput>./configure --prefix=/usr       \
            --disable-ssh-token \
            --disable-asciidoc  &amp;&amp;
make</userinput></screen>

    <para>
      To test the result, issue as the <systemitem
      class="username">root</systemitem> user: <command>make check</command>.
      Some tests will fail if appropriate kernel configuration options are not
      set. Some additional options that may be needed for tests are:
<screen><literal>CONFIG_SCSI_LOWLEVEL,
CONFIG_SCSI_DEBUG,
CONFIG_BLK_DEV_DM_BUILTIN,
CONFIG_CRYPTO_USER,
CONFIG_CRYPTO_CRYPTD,
CONFIG_CRYPTO_LRW,
CONFIG_CRYPTO_XTS,
CONFIG_CRYPTO_ESSIV,
CONFIG_CRYPTO_CRCT10DIF,
CONFIG_CRYPTO_AES_TI,
CONFIG_CRYPTO_AES_NI_INTEL,
CONFIG_CRYPTO_BLOWFISH,
CONFIG_CRYPTO_CAST5,
CONFIG_CRYPTO_SERPENT,
CONFIG_CRYPTO_SERPENT_SSE2_X86_64,
CONFIG_CRYPTO_SERPENT_AVX_X86_64,
CONFIG_CRYPTO_SERPENT_AVX2_X86_64, and
CONFIG_CRYPTO_TWOFISH_X86_64</literal></screen>
      <!--I had 1 of 21 tests fail with the above crypto options in the
      kernel.  Eight tests were not run.  Version 2.4.3.
      Failed test  was tcrypt-compat-test
      tcrypt-images/tc_1-ripemd160-cbc-aes [FAILED]
      bdubbs 

      Version 2.6.1 12/03/2023 -bdubbs
      2 of 26 tests failed (6 tests were not run)
      FAIL: keyring-compat-test
      FAIL: tcrypt-compat-test

      Version 2.7.0 01/25/2024 -bdubbs
      2 of 25 tests failed (8 tests were not run)
      FAIL: keyring-compat-test
      FAIL: tcrypt-compat-test
      -->
    </para>

    <para>
      Now, as the <systemitem class="username">root</systemitem> user:
    </para>

<screen role="root"><userinput>make install</userinput></screen>

  </sect2>

  <sect2 role="commands">
    <title>Command Explanations</title>

    <para>
      <parameter>--disable-ssh-token</parameter>:  This switch is required if
      the optional libssh dependency is not installed.
    </para>
    
    <para>
      <parameter>--disable-asciidoc</parameter>: This switch disables
      regeneration of the man pages. Remove this switch if you have
      <xref linkend="asciidoctor" role="nodep"/> installed and wish to
      regenerate the man pages.  Note that even if this switch is used,
      the pre-generated man pages are shipped in the tarball and they'll
      still be installed.
    </para>
  </sect2>

  <sect2 role="configuration">
    <title>Configuring cryptsetup</title>

    <para>
      Because of the number of possible configurations, setup of encrypted
      volumes is beyond the scope of the BLFS book. Please see the
      configuration guide in the cryptsetup <ulink
      url="https://gitlab.com/cryptsetup/cryptsetup/wikis/FrequentlyAskedQuestions#2-setup">
      FAQ</ulink>.
    </para>

  </sect2>

  <sect2 role="content">
    <title>Contents</title>

    <segmentedlist>
      <segtitle>Installed Programs</segtitle>
      <segtitle>Installed Libraries</segtitle>
      <segtitle>Installed Directories</segtitle>

      <seglistitem>
        <seg>
          cryptsetup,
          cryptsetup-reencrypt,
          integritysetup, and
          veritysetup
        </seg>
        <seg>
          libcryptsetup.so
        </seg>
        <seg>
          None
        </seg>
      </seglistitem>
    </segmentedlist>

    <variablelist>
      <bridgehead renderas="sect3">Short Descriptions</bridgehead>
      <?dbfo list-presentation="list"?>
      <?dbhtml list-presentation="table"?>

      <varlistentry id="cryptsetup-prog">
        <term><command>cryptsetup</command></term>
        <listitem>
          <para>
            is used to setup dm-crypt managed device-mapper mappings
          </para>
          <indexterm zone="cryptsetup cryptsetup-prog">
            <primary sortas="b-cryptsetup">cryptsetup</primary>
          </indexterm>
        </listitem>
      </varlistentry>

      <varlistentry id="cryptsetup-reencrypt">
        <term><command>cryptsetup-reencrypt</command></term>
        <listitem>
          <para>
            is a tool for offline LUKS device re-encryption
          </para>
          <indexterm zone="cryptsetup cryptsetup-reencrypt">
            <primary sortas="b-cryptsetup-reencrypt">cryptsetup-reencrypt</primary>
          </indexterm>
        </listitem>
      </varlistentry>

      <varlistentry id="integritysetup">
        <term><command>integritysetup</command></term>
        <listitem>
          <para>
            is a tool to manage dm-integrity (block level integrity) volumes
          </para>
          <indexterm zone="cryptsetup integritysetup">
            <primary sortas="b-integritysetup">integritysetup</primary>
          </indexterm>
        </listitem>
      </varlistentry>

      <varlistentry id="veritysetup">
        <term><command>veritysetup</command></term>
        <listitem>
          <para>
            is used to configure dm-verity managed device-mapper mappings.
            The Device-mapper verity target provides read-only transparent
            integrity checking of block devices using the kernel crypto API
          </para>
          <indexterm zone="cryptsetup veritysetup">
            <primary sortas="b-veritysetup">veritysetup</primary>
          </indexterm>
        </listitem>
      </varlistentry>

    </variablelist>

  </sect2>

</sect1>