lukS

Linux Unified Key Setup (LUKS) is a standard for disk encryption on Linux that defines the on-disk format for dm-crypt encrypted volumes. It provides a unified, interoperable method for storing and managing encryption keys, allowing multiple passphrases or key files to unlock the same encrypted device.

How it works: When a LUKS volume is created, a random master key is generated to encrypt the data. The master key is itself encrypted with a key derived from each provided passphrase or key file and stored in multiple key slots embedded in the LUKS header. Typical implementations support multiple key slots, enabling several different passphrases to unlock the same volume. To access the data, a user provides a valid passphrase or key file, which unlocks a key slot to reveal the master key, which then decrypts the data encryption key used for the volume. LUKS also supports adding, removing, or changing key slots without re-encrypting the data.

Versions and features: LUKS1 is the original on-disk format, widely supported by cryptsetup and Linux distributions. LUKS2, introduced with newer cryptsetup tools, adds a more flexible metadata layout, improved error handling, and support for modern key derivation functions such as Argon2id, alongside continued compatibility with LUKS1. LUKS2 also offers greater configurability for header location, padding, and optional metadata redundancy.

Usage: LUKS volumes are typically managed with cryptsetup, using commands to format, open, close, add or remove keys, and resize. It is commonly applied to full-disk or partition encryption on laptops, servers, and removable media.

Security considerations: The strength of LUKS relies on the chosen passphrase or key files and the configured key derivation function. Backups of the header are important; loss of the header can make data irrecoverable.

---