Cryptsetup Linux Disk Encryption Tool

cryptsetup is a free and open-source utility for managing disk encryption on Linux, implementing the LUKS (Linux Unified Key Setup) specification and providing a command-line interface for creating, accessing, and managing encrypted disk partitions. Originally developed by Clemens Fruhwirth in 2004 as part of his thesis at Technical University of Munich, cryptsetup is now maintained by Red Hat engineers Milan Broz and Ondrej Kozina. Key features: LUKS is the standard for Linux hard disk encryption, providing a header on the encrypted partition that stores key slots (up to 8 for LUKS1, up to 32 for LUKS2), key derivation parameters, and encryption algorithm metadata. LUKS2 (cryptsetup 2.0+, 2017): improved header format with JSON metadata, Argon2 key derivation function (replacing PBKDF2), token interface for external key storage (TPM2, FIDO2, smartcards), and online re-encryption. Plain dm-crypt mode: low-level encryption mode without a header, suitable for encrypted swap partitions and temporary containers. Encryption algorithms: AES (128/256-bit), Serpent, Twofish, and cascaded combinations, operating in XTS mode for disk encryption. Key derivation: PBKDF2 (HMAC-SHA256/SHA512) and Argon2i/Argon2id (LUKS2) with configurable memory cost, parallelism, and iterations. Token support: integration with external key managers via LUKS2 tokens, enabling TPM2 sealed keys, FIDO2 keys, and PKCS#11 smartcard unlocking. Integrity protection: authenticated disk encryption (dm-integrity) with HMAC for data tamper detection. Loopback device management: create encrypted containers as files. Integration: systemd-cryptsetup for boot-time unlocking via /etc/crypttab, dracut, and initramfs. YubiKey challenge-response authentication. GitLab development. GPL-2.0.