Secure Your Data: How to Encrypt a Partition or Disk on Linux

While no method can guarantee 100% security for your data, encryption provides a highly reliable layer of protection, making it significantly more difficult for hackers and unauthorized users to access your private information. In this tutorial, we’ll explore the best encryption solutions available for Linux users and walk you through the process of creating an encrypted partition step by step.

LUKS or VeraCrypt?

Linux users have several options for file and directory encryption (Stacked filesystem encryption), but when it comes to encrypting entire disks or partitions (Block device encryption), two prominent and reliable solutions stand out: LUKS and VeraCrypt, both of which are open-source.

LUKS: The Standard

LUKS (Linux Unified Key Setup) is the standard specification for disk encryption on Linux, leveraging the dm-crypt subsystem in the Linux kernel for its cryptographic operations. When you choose encryption during the installation of your favorite Linux distribution, it’s typically based on LUKS unless specified otherwise.

LUKS provides robust security by allowing multiple passwords (keys) to unlock the same encrypted partition. It also supports backup and restoration of the encryption header, a small block of metadata that includes information about the encryption algorithms (ciphers), type, and mode. Think of it as a gate with multiple key slots.

LUKS enables you to add and remove keys without reformatting (re-encrypting) the partition or disk. It uses PBKDF2 to strengthen passphrases, which involves hashing the password with a unique salt multiple times, making it much harder for attackers to crack. 

LUKS2, the updated version, introduces enhancements like support for advanced key derivation functions (KDFs) such as Argon2id, which offers improved resistance against password cracking, especially against GPU-powered attacks.

LUKS2 also features JSON-based metadata, making it easier to extend and parse, with better redundancy and multiple metadata copies to prevent data loss. While LUKS uses AES in XTS mode with a 512-bit key by default—providing high security and performance—it also supports other ciphers like Serpent, Twofish, and Camellia.

Thanks to Systemd-cryptsetup integration, LUKS works seamlessly with systemd, facilitating smooth management and access to encrypted block devices. Although LUKS lacks a graphical interface for encryption, many disk management tools, such as KDE‘s Disk Management, offer GUIs for creating encrypted disks or partitions on Linux.

LUKS is versatile, capable of encrypting any partition regardless of its filesystem. Whether you prefer the widely-used Ext4, the high-performance XFS, the feature-rich Btrfs, or even the Windows-centric NTFS, LUKS acts as a universal encrypter, ensuring your data remains private. However, due to potential compatibility issues and performance implications, encrypting an entire NTFS disk with LUKS is generally not recommended. Additionally, LUKS does not support cipher combinations or hidden volumes, which brings us to VeraCrypt.

VeraCrypt: The Contender

Derived from the discontinued TrueCrypt, VeraCrypt is a free and open-source encryption tool available on Linux, Windows, and macOS. Unlike LUKS, VeraCrypt offers a user-friendly graphical interface in addition to its console version, making it easy to encrypt and configure disks and partitions.

VeraCrypt allows you to create hidden volumes for plausible deniability, where one volume is concealed within another. It provides protection against data corruption or accidental overwrites of hidden volumes while they are mounted. However, this protection is not active when the hidden volume is unmounted.

A hidden volume is akin to a secret compartment within a locked safe—providing an extra layer of protection for your most sensitive data. However, this compartment is fragile and can be easily damaged by accidental overwrites or improper handling.

VeraCrypt supports the PBKDF2 Key Derivation Function (KDF) with various hash algorithms, including SHA-512, SHA-256, and RIPEMD-160. However, it does not yet support more advanced KDFs like Argon2id, which is available in LUKS2. Additionally, VeraCrypt is compatible with common filesystems such as Ext4, Btrfs, and NTFS.

Unlike LUKS, VeraCrypt supports cipher combinations such as AES-Serpent, AES-Twofish, Serpent-Twofish, and AES-Serpent-Twofish.

It’s worth noting that VeraCrypt is not as deeply integrated into Linux as LUKS, which may result in slightly lower performance.

So, which encryption tool will you choose for your Linux system?

Creating an Encrypted Partition

To create an encrypted partition or disk on Linux, you can choose between two methods: command-line or graphical user interface (GUI). For LUKS, I recommend the command-line approach, as GUI tools often provide only basic configuration options. Conversely, VeraCrypt’s native GUI offers a more user-friendly experience. The choice depends on your preference.

Before encrypting, you’ll need to allocate space by creating a partition on any available free space on your disk. For a simpler process, I suggest using a GUI tool. If you’re on a GTK-based desktop like GNOME, use Disks; for a Qt-based desktop, KDE Partition Manager is ideal. Alternatively, if you prefer the command line, follow the steps below to create a partition manually:

1. Identify Disks: Use `fdisk -l` to list available disks:

sudo fdisk -l

2. Open fdisk:

sudo fdisk /dev/nvme0n1

3. Print Partition Table: View the current disk layout with the `p` command:

p

4. Create New Partition:

n

• Set Partition Type:

t

• Write Changes:

w

5. Format the Partition: To format the newly created partition with a filesystem (e.g., Ext4), use the mkfs command:

sudo mkfs.ext4 /dev/nvme0n1p7

Now, you can proceed to encrypt it using LUKS or VeraCrypt.

Encrypting a Partition or Disk with LUKS

As discussed in the previous section, when creating an encrypted partition using LUKS, there are several configuration options you can apply to tailor the encryption to your needs. Below are examples with various options explained. Since LUKS1 is less secure than LUKS2, I highly recommend using LUKS2.

Basic LUKS Initialization

The basic LUKS encryption of a partition can be done easily using a simple command line or a disk management tool such as Disks or KDE Partition Manager. If you use them to create the partition, you may notice the encryption option.

The command-line method is as follows:

sudo cryptsetup luksFormat --type luks2 /dev/nvmeXnYpZ

This initializes a LUKS2-encrypted partition using default settings like AES with a 256-bit key and Argon2id for key derivation. Remember to replace the placeholder with the actual path to your NVMe partition (e.g., /dev/nvme0n1p7).

Advanced LUKS Initialization

When creating an encrypted partition using LUKS2, there are several options and configurations you can apply to tailor the encryption to your needs. Below are examples with various options explained.

• Specifying the Cipher and Key Size

sudo cryptsetup luksFormat --type luks2 --cipher aes-xts-plain64 --key-size 512 /dev/nvmeXnYpZ

• Choosing a Different Hash Algorithm

sudo cryptsetup luksFormat --type luks2 --hash sha512 /dev/nvmeXnYpZ

• Using a Random Number Generator

sudo cryptsetup luksFormat --type luks2 --use-random /dev/nvmeXnYpZ

• Using Argon2id Key Derivation

sudo cryptsetup luksFormat --type luks2 --pbkdf argon2id /dev/nvmeXnYpZ

• Setting a Custom Iteration Time for Key Derivation

sudo cryptsetup luksFormat --type luks2 --iter-time 5000 /dev/nvmeXnYpZ

• Increasing the Number of Key Slots

sudo cryptsetup luksFormat --type luks2 --key-slot 8 /dev/nvmeXnYpZ

• Adding a Keyfile

sudo cryptsetup luksFormat --type luks2 --key-file /path/to/keyfile /dev/nvmeXnYpZ

• Using a Detached LUKS2 Header

sudo cryptsetup luksFormat --type luks2 --header /path/to/header /dev/nvmeXnYpZ

• Creating an Encrypted Partition with Custom Sector Size

sudo cryptsetup luksFormat --type luks2 --sector-size 4096 /dev/nvmeXnYpZ

• Using a Cipher with GCM Mode (Authenticated Encryption)

sudo cryptsetup luksFormat --type luks2 --cipher aes-gcm /dev/nvmeXnYpZ

• Enabling Key Escrow

sudo cryptsetup luksFormat --type luks2 --master-key-file /path/to/keyfile /dev/nvmeXnYpZ

• Specifying the Use of TRIM on Encrypted Partition

sudo cryptsetup luksFormat --type luks2 --allow-discards /dev/nvmeXnYpZ

• Adding or Removing a Passphrase

sudo cryptsetup luksAddKey /dev/nvmeXnYpZ
sudo cryptsetup luksRemoveKey /dev/nvmeXnYpZ

• A complete command might look like this:

sudo cryptsetup luksFormat --cipher aes-xts-plain64 --key-size 512 --hash sha512 --sector-size 4096 --pbkdf argon2id --iter-time 5000 --header /path/to/header --use-random /dev/nvmeXnYpZ

This command would:

• Use AES with XTS mode and a 512-bit key.
• Use SHA-512 for passphrase hashing.
• Set the sector size to 4096 bytes.
• Use Argon2id as the KDF.
• Spend 5000 milliseconds in passphrase processing.
• Store the LUKS header separately.
• Use a secure random number generator for initializing the encryption.

Using the above command lines, you just created an encrypted partition block device without a filesystem within it. To store data, you need to create a filesystem:

1. Open the LUKS Partition: Unlock the encrypted partition to make it available for formatting and use:

sudo cryptsetup open /dev/nvmeXnYpZ encrypted_partition

2. Create a Filesystem on the Encrypted Partition: Format the opened LUKS device with the desired filesystem (e.g., ext4):

sudo mkfs.ext4 /dev/mapper/encrypted_partition

3. Mount the Encrypted Partition: Mount the encrypted partition to a directory:

sudo mount /dev/mapper/encrypted_partition /mnt

4. Close the Encrypted Partition: When done, unmount and close the encrypted partition:

sudo umount /mnt
sudo cryptsetup close encrypted_partition

5. Additional LUKS Options and Management

• Check LUKS Status:

sudo cryptsetup luksDump /dev/nvmeXnYpZ

• Change the encrypted partition label:

sudo cryptsetup config /dev/nvmeXnYpZ --label="NewLabel"

• Backup LUKS Header: It is highly recommended to backup the LUKS header. If the header is damaged, you will lose access to your data:

sudo cryptsetup luksHeaderBackup /dev/nvmeXnYpZ --header-backup-file /path/to/backup/backup_header.img

After our deep dive into LUKS and its intricacies, let’s explore how to create encrypted partitions using VeraCrypt.

Encrypting a Partition or Disk with VeraCrypt

While VeraCrypt might have been available in some Linux repositories in the past, it’s no longer commonly included. Here’s how to install and use it:

1. Download VeraCrypt: Visit the official website (https://www.veracrypt.fr/en/Downloads.html) and download the appropriate installer for your Linux distribution. Make sure to choose the GUI (Graphical User Interface) version for a user-friendly experience.
2. Use your package manager: Most Linux distributions have software centers or package managers (like Ubuntu Software, GNOME Software, or KDE Discover). Locate the downloaded VeraCrypt, open it with the package manager, and click the “Install” button. 

Once VeraCrypt is installed, you can easily launch it from your applications menu and start creating encrypted volumes:

1. Open VeraCrypt: Launch the VeraCrypt application.
2. Create Volume: Click on the “Create Volume” option to start the encryption process.

3. Select Encryption Type: Choose “Encrypt non-system partition/drive” and click “Next.”

4. Volume Type: Decide whether to create a standard VeraCrypt volume or a hidden VeraCrypt volume. Click “Next.”

5. Select Device: Click on “Select Device” to choose the partition or disk you want to encrypt. Ensure you select the correct partition or disk as this process will overwrite existing data.

6. Configure Encryption: Configure the encryption algorithm and key length. Click “Next.”

7. Password and Keyfiles: Create a strong password for the volume and optionally use keyfiles for added security. To use the keyfile, click “Use Keyfile” and browse to the location where you saved it.

8. Large Files Option: Specify whether you intend to store “Large files” on the encrypted volume (yes or no).

9. Choose Filesystem: Select the filesystem you want to use for the volume from the available options.

10. Cross-Platform Compatibility: Decide whether you want the volume to be accessible from other operating systems (click “Next”).

11. Configure Randomness: Adjust the randomness settings for the header and master key by moving your mouse to generate sufficient entropy.

12. Format Volume: Click “Format” to begin the formatting process and wait until it completes.

Once the partition is encrypted, you can mount it using a file manager to start storing and accessing your secured data.

After you’re done using the encrypted partition, right-click on the mounted partition/drive in your file manager and select “Unmount” to protect your data and avoid corruption, especially with external drives. Then, open VeraCrypt, select the mounted volume, and click “Dismount” to securely disconnect the encrypted partition. 

Conclusion

To sum up, disk encryption is a crucial step for safeguarding your sensitive data on Linux. Whether you opt for LUKS with its deep integration into the Linux ecosystem or VeraCrypt for its ease of use and flexibility, both provide robust protection against unauthorized access. The choice ultimately depends on your specific needs, preferences, and comfort level with command-line tools versus graphical interfaces.

While we’ve covered the essential steps to set up encrypted partitions and disks using these tools, there’s always room to enhance security further. One approach is to consider integrating hardware-based security mechanisms, such as a FIDO security key or a Trusted Platform Module (TPM), as an additional layer of protection for your encrypted drives.

💬 Would you be interested in a future blog post that dives into how to implement hardware-based security measures like FIDO security keys and TPMs to bolster the security of your encrypted partitions? Let me know in the comments or reach out to me directly!