,,LUKS THE ,LINUX ,UNIFIED ,KEY ,SETUP IS THE ON-DISK STANDARD THAT MADE DISK ENCRYPTION BORING ON PURPOSE3 SPECIFIED BY ,CLEMENS ,FRUHWIRTH IN #BJJD AND IMPLEMENTED THROUGH CRYPTSETUP SINCE @9#BJJE1 IT DEFINES A HEADER FORMAT ON TOP OF THE KERNEL'S DM-CRYPT DEVICE-MAPPER TARGET SO ANY TOOL THAT SPEAKS ,,LUKS CAN UNLOCK ANY ,,LUKS VOLUME NO VENDOR LOCK1 NO GUESSING AT LAYOUTS4 ,,LUKS#A VS ,,LUKS#B ,,LUKS#A STORES A FIXED BINARY HEADER3 SALT "6 MASTER-KEY CHECKSUM "6 EIGHT KEYSLOTS1 EACH PROTECTING THE MASTER KEY WITH ,,PBKDF#B WHICH IS WHY A VOLUME CAN HAVE A LAPTOP PASSPHRASE1 A RECOVERY PASSPHRASE1 AND A KEYFILE ALL AT ONCE4 ,,LUKS#B " REPLACED THE BINARY HEADER WITH ,,JSON METADATA1 SWAPPED ,,PBKDF#B FOR MEMORY-HARD ,ARGON#B1 RAISED KEYSLOTS TO #CB1 AND ADDED AUTHENTICATED ONLINE RE-ENCRYPTION AND DETACHED HEADERS4 CRYPTSETUP LUKS,FORMAT WRITES IT2 LUKS,OPEN MAPS THE PLAINTEXT DEVICE AS _/DEV_/MAPPER_/@2 SYSTEMD-CRYPTENROLL ADDS ,,TPM#B AND ,,FIDO#B-TOKEN UNLOCKING FOR THE NO-PASSPHRASE BOOT4 ,WHERE IT SITS IN THE HANDBOOK ,,LUKS IS THE ENCRYPTION HALF OF CHAPTER #BA'S STORAGE STORY3 PARTITION LUKS,FORMAT LUKS,OPEN FILESYSTEM INSIDE THE MAPPER CRYPTTAB "6 INITRAMFS HOOKS SO THE INIT PROMPTS AT BOOT AND ,,GRUB'S LUKS_/LUKS#B MODULES CAN EVEN READ AN ENCRYPTED _/BOOT4 ,THE SECURITY CHAPTER TREATS IT AS THE BASELINE3 A LAPTOP WITHOUT FULL-DISK ENCRYPTION FAILS THE CHECKLIST BEFORE ANYTHING ELSE IS EXAMINED4 ,SEE ALSO - ,DISKS AND ,STORAGE PARTITIONING THROUGH CRYPTTAB - ,LINUX ,SECURITY THE ENCRYPTION BASELINE - ,INSIDE A ,LINUX ,SYSTEM DEVICE-MAPPER'S PLACE IN THE STACK - ,LINUX ,,GRUB NFTABLES