LUKS1

LUKS1, short for Linux Unified Key Setup version 1, is a disk encryption specification used with the Linux dm-crypt subsystem. It provides a standard header-based format for encrypting entire storage devices, storing the parameters necessary to unlock the volume and access the underlying data. LUKS1 is commonly used through the cryptsetup tool and has been widely adopted across Linux distributions.

A defining feature of LUKS1 is its key-slot mechanism. The on-disk header supports up to eight key slots, each able to hold data that allows one passphrase or key to unlock the volume. Each slot contains a salt, iteration count for a key derivation function (KDF), and an encrypted copy of the master key. The master key is the actual key used to encrypt and decrypt the data on the device. When unlocking the volume, the system derives a key from the provided passphrase using the slot’s KDF parameters; if successful, the master key is decrypted and the data becomes accessible through the device mapper.

The header also stores the chosen cipher algorithm, mode, key size, and a unique UUID for the encrypted device. It is essential to back up the LUKS header, because damage to the header can render data unrecoverable even if the ciphertext remains intact. Adding or removing passphrases involves updating the corresponding key slots and re-encrypting the master key.

LUKS1 remains widely supported and in use, but LUKS2, the newer standard, offers improvements in metadata handling, integrity options, and flexibility. For new deployments, LUKS2 is generally recommended, while LUKS1 continues to be encountered in existing systems and older setups.