source: postlfs/security/cryptsetup.xml@ de70936

<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
   "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
  <!ENTITY % general-entities SYSTEM "../../general.ent">
  %general-entities;

  <!ENTITY cryptsetup-download-http "&kernel-dl;/linux/utils/cryptsetup/v&cryptsetup-minor;/cryptsetup-&cryptsetup-version;.tar.xz">
  <!ENTITY cryptsetup-download-ftp  " ">
  <!ENTITY cryptsetup-md5sum        "2303d57e78d4977344188a46e125095c">
  <!ENTITY cryptsetup-size          "11 MB">
  <!ENTITY cryptsetup-buildsize     "29 MB (add 5 MB for tests)">
  <!ENTITY cryptsetup-time          "0.2 SBU (add 19 SBU for tests)">
]>

<sect1 id="cryptsetup" xreflabel="cryptsetup-&cryptsetup-version;">
  <?dbhtml filename="cryptsetup.html"?>


  <title>cryptsetup-&cryptsetup-version;</title>

  <indexterm zone="cryptsetup">
    <primary sortas="a-cryptsetup">cryptsetup</primary>
  </indexterm>

  <sect2 role="package">
    <title>Introduction to cryptsetup</title>

    <para>
      cryptsetup is used to set up transparent encryption of block devices
      using the kernel crypto API.
    </para>

    &lfs113_checked;

    <bridgehead renderas="sect3">Package Information</bridgehead>
    <itemizedlist spacing="compact">
      <listitem>
        <para>
          Download (HTTP): <ulink url="&cryptsetup-download-http;"/>
        </para>
      </listitem>
      <listitem>
        <para>
          Download (FTP): <ulink url="&cryptsetup-download-ftp;"/>
        </para>
      </listitem>
      <listitem>
        <para>
          Download MD5 sum: &cryptsetup-md5sum;
        </para>
      </listitem>
      <listitem>
        <para>
          Download size: &cryptsetup-size;
        </para>
      </listitem>
      <listitem>
        <para>
          Estimated disk space required: &cryptsetup-buildsize;
        </para>
      </listitem>
      <listitem>
        <para>
          Estimated build time: &cryptsetup-time;
        </para>
      </listitem>
    </itemizedlist>

<!-- No longer needed with 2.3.2.
    <bridgehead renderas="sect3">Additional Downloads</bridgehead>
    <itemizedlist spacing="compact">
      <listitem>
        <para>
          Required patch:
          <ulink url="&patch-root;/cryptsetup-&cryptsetup-version;-upstream_fixes-1.patch"/>
        </para>
      </listitem>
    </itemizedlist>
-->

    <bridgehead renderas="sect3">cryptsetup Dependencies</bridgehead>

    <bridgehead renderas="sect4">Required</bridgehead>
    <para role="required">
      <xref linkend="json-c"/>,
      <xref linkend="lvm2"/>, and
      <xref linkend="popt"/>
    </para>

    <bridgehead renderas="sect4">Optional</bridgehead>
    <para role="optional">
      <xref linkend="libpwquality"/>,
      <ulink url="https://github.com/P-H-C/phc-winner-argon2">argon2</ulink>,
      <ulink url="https://www.libssh.org/">libssh</ulink>, and
      <ulink url="https://www.openwall.com/passwdqc/">passwdqc</ulink>
    </para>


  </sect2>

  <sect2 role="kernel" id="cryptsetup-kernel">
    <title>Kernel Configuration</title>

    <para>
      Encrypted block devices require kernel support.  To use it, the
      appropriate kernel configuration parameters need to be set:
    </para>

<screen><literal>Device Drivers  ---&gt;
  [*] Multiple devices driver support (RAID and LVM) ---&gt; [CONFIG_MD]
       &lt;*/M&gt; Device mapper support                        [CONFIG_BLK_DEV_DM]
       &lt;*/M&gt; Crypt target support                         [CONFIG_DM_CRYPT]

-*- Cryptographic API  ---&gt;                               [CONFIG_CRYPTO]
      Length-preserving ciphers and modes ---&gt;
        &lt;*/M&gt; XTS support                                 [CONFIG_CRYPTO_XTS]
      Hashes, digests, and MACs  --->
        -*- SHA224 and SHA256 digest algorithm            [CONFIG_CRYPTO_SHA256]
      Block ciphers  --->
        -*- AES cipher algorithms                         [CONFIG_CRYPTO_AES]
      Userspace interface  --->
        &lt;*/M&gt; Symmetric key cipher algorithms             [CONFIG_CRYPTO_USER_API_SKCIPHER]
  For tests:
      Block ciphers  --->
        &lt;*/M&gt; Twofish                                     [CONFIG_CRYPTO_TWOFISH]</literal></screen>

    <indexterm zone="cryptsetup cryptsetup-kernel">
      <primary sortas="d-cryptsetup">cryptsetup</primary>
    </indexterm>

  </sect2>

    <sect2 role="installation">
      <title>Installation of cryptsetup</title>

<!-- No longer needed with 2.3.2
    <para>
      First, apply a patch to fix a build problem caused by API changes in
      <xref role="nodep" linkend="json-c"/>:
    </para>

<screen><userinput remap="pre">patch -Np1 -i ../cryptsetup-&cryptsetup-version;-upstream_fixes-1.patch</userinput></screen>
-->

    <para>
      Install <application>cryptsetup</application> by running the following
      commands:
    </para>

<screen><userinput>./configure --prefix=/usr --disable-ssh-token &amp;&amp;
make</userinput></screen>

    <para>
      To test the result, issue as the <systemitem
      class="username">root</systemitem> user: <command>make check</command>.
      Some tests will fail if appropriate kernel configuration options are not
      set. Some additional options that may be needed for tests are:
      CONFIG_SCSI_LOWLEVEL,
      CONFIG_SCSI_DEBUG,
      CONFIG_BLK_DEV_DM_BUILTIN,
      CONFIG_CRYPTO_USER,
      CONFIG_CRYPTO_CRYPTD,
      CONFIG_CRYPTO_LRW,
      CONFIG_CRYPTO_XTS,
      CONFIG_CRYPTO_ESSIV,
      CONFIG_CRYPTO_CRCT10DIF,
      CONFIG_CRYPTO_AES_TI,
      CONFIG_CRYPTO_AES_NI_INTEL,
      CONFIG_CRYPTO_BLOWFISH,
      CONFIG_CRYPTO_CAST5,
      CONFIG_CRYPTO_SERPENT,
      CONFIG_CRYPTO_SERPENT_SSE2_X86_64,
      CONFIG_CRYPTO_SERPENT_AVX_X86_64,
      CONFIG_CRYPTO_SERPENT_AVX2_X86_64, and
      CONFIG_CRYPTO_TWOFISH_X86_64.
      <!--I had 1 of 21 tests fail with the above crypto options in the
      kernel.  Eight tests were not run.  Version 2.4.3.
      Failed test  was tcrypt-compat-test
      tcrypt-images/tc_1-ripemd160-cbc-aes [FAILED]
      bdubbs -->
    </para>

    <para>
      Now, as the <systemitem class="username">root</systemitem> user:
    </para>

<screen role="root"><userinput>make install</userinput></screen>

  </sect2>

  <sect2 role="commands">
    <title>Command Explanations</title>
    <para>
      <option>--disable-ssh-token</option>:  This option is required if
      the optional libssh dependency is not installed.
    </para>
  </sect2>

  <sect2 role="configuration">
    <title>Configuring cryptsetup</title>

    <para>
      Because of the number of possible configurations, setup of encrypted
      volumes is beyond the scope of the BLFS book. Please see the
      configuration guide in the cryptsetup <ulink
      url="https://gitlab.com/cryptsetup/cryptsetup/wikis/FrequentlyAskedQuestions#2-setup">
      FAQ</ulink>.
    </para>

  </sect2>

  <sect2 role="content">
    <title>Contents</title>

    <segmentedlist>
      <segtitle>Installed Programs</segtitle>
      <segtitle>Installed Libraries</segtitle>
      <segtitle>Installed Directories</segtitle>

      <seglistitem>
        <seg>
          cryptsetup,
          cryptsetup-reencrypt,
          integritysetup, and
          veritysetup
        </seg>
        <seg>
          libcryptsetup.so
        </seg>
        <seg>
          None
        </seg>
      </seglistitem>
    </segmentedlist>

    <variablelist>
      <bridgehead renderas="sect3">Short Descriptions</bridgehead>
      <?dbfo list-presentation="list"?>
      <?dbhtml list-presentation="table"?>

      <varlistentry id="cryptsetup-prog">
        <term><command>cryptsetup</command></term>
        <listitem>
          <para>
             is used to setup dm-crypt managed device-mapper mappings
          </para>
          <indexterm zone="cryptsetup cryptsetup-prog">
            <primary sortas="b-cryptsetup">cryptsetup</primary>
          </indexterm>
        </listitem>
      </varlistentry>

      <varlistentry id="cryptsetup-reencrypt">
        <term><command>cryptsetup-reencrypt</command></term>
        <listitem>
          <para>
             is a tool for offline LUKS device re-encryption
          </para>
          <indexterm zone="cryptsetup cryptsetup-reencrypt">
            <primary sortas="b-cryptsetup-reencrypt">cryptsetup-reencrypt</primary>
          </indexterm>
        </listitem>
      </varlistentry>

      <varlistentry id="integritysetup">
        <term><command>integritysetup</command></term>
        <listitem>
          <para>
             is a tool to manage dm-integrity (block level integrity) volumes
          </para>
          <indexterm zone="cryptsetup integritysetup">
            <primary sortas="b-integritysetup">integritysetup</primary>
          </indexterm>
        </listitem>
      </varlistentry>

      <varlistentry id="veritysetup">
        <term><command>veritysetup</command></term>
        <listitem>
          <para>
             is used to configure dm-verity managed device-mapper mappings.
             Device-mapper verity target provides read-only transparent integrity
             checking of block devices using kernel crypto API
          </para>
          <indexterm zone="cryptsetup veritysetup">
            <primary sortas="b-veritysetup">veritysetup</primary>
          </indexterm>
        </listitem>
      </varlistentry>

    </variablelist>

  </sect2>

</sect1>