LUKS
LUKS — the Linux Unified Key Setup — is the on-disk standard that made disk encryption boring on purpose: specified by Clemens Fruhwirth in 2004 and implemented through cryptsetup since ~2005, it defines a header format on top of the kernel's dm-crypt device-mapper target so any tool that speaks LUKS can unlock any LUKS volume — no vendor lock, no guessing at layouts.[1]
LUKS1 vs LUKS2
LUKS1 stores a fixed binary header: salt + master-key checksum + eight keyslots, each protecting the master key with PBKDF2 — which is why a volume can have a laptop passphrase, a recovery passphrase, and a keyfile all at once. LUKS2 (cryptsetup 2.0, December 2017) replaced the binary header with JSON metadata, swapped PBKDF2 for memory-hard Argon2, raised keyslots to 32, and added authenticated online re-encryption and detached headers. cryptsetup luksFormat writes it; luksOpen maps the plaintext device as /dev/mapper/<name>; systemd-cryptenroll adds TPM2 and FIDO2-token unlocking for the no-passphrase boot.[2]
Where it sits in the handbook
LUKS is the encryption half of chapter 21's storage story: partition → luksFormat → luksOpen → filesystem inside the mapper → crypttab + initramfs hooks so the init prompts at boot — and GRUB's luks/luks2 modules can even read an encrypted /boot. The security chapter treats it as the baseline: a laptop without full-disk encryption fails the checklist before anything else is examined.[3]
See also
- Disks and Storage — partitioning through crypttab
- Linux Security — the encryption baseline
- Inside a Linux System — device-mapper's place in the stack
- Linux · GRUB · Nftables