#### Beyond Linux® From Scratch (systemd Edition) - Version r13.0-491

### Chapter 4. Security

- Prev

  CrackLib-2.10.3

- Next

  Cyrus SASL-2.1.28

- Up
- Home

# cryptsetup-2.8.6

## Introduction to cryptsetup

cryptsetup is used to set up transparent encryption of block devices using the kernel crypto API.

### Note

Development versions of BLFS may not build or run some packages properly if LFS or dependencies have been updated since the most recent stable versions of the books.

### Package Information

- Download (HTTP): https://www.kernel.org/pub/linux/utils/cryptsetup/v2.8/cryptsetup-2.8.6.tar.xz

- Download MD5 sum: 110d3dd2dec73401a087f526f598f884

- Download size: 12 MB

- Estimated disk space required: 41 MB (add 5 MB for tests)

- Estimated build time: 0.2 SBU (add 19 SBU for tests)

### cryptsetup Dependencies

#### Required

JSON-C-0.18, LVM2-2.03.39, and popt-1.19

#### Optional

asciidoctor-2.0.26, libpwquality-1.4.5, argon2, libssh, mbedtls, and passwdqc

## Kernel Configuration

Encrypted block devices require kernel support. To use it, the appropriate kernel configuration parameters need to be set:

    Device Drivers --->
      [*] Multiple devices driver support (RAID and LVM) --->                   [MD]
        <*/M> Device mapper support                                     [BLK_DEV_DM]
        <*/M>   Crypt target support                                      [DM_CRYPT]

    -*- Cryptographic API --->                                              [CRYPTO]
      Block ciphers --->
        <*/M> AES (Advanced Encryption Standard)                        [CRYPTO_AES]
        # For tests:
        <*/M> Twofish                                               [CRYPTO_TWOFISH]
      Length-preserving ciphers and modes --->
        <*/M> XTS (XOR Encrypt XOR with ciphertext stealing)            [CRYPTO_XTS]
      Hashes, digests, and MACs --->
        <*/M> SHA-224 and SHA-256                                    [CRYPTO_SHA256]
      Userspace interface --->
        <*/M> Symmetric key cipher algorithms             [CRYPTO_USER_API_SKCIPHER]

## Installation of cryptsetup

Install cryptsetup by running the following commands:

    ./configure --prefix=/usr       \
                --disable-ssh-token \
                --disable-asciidoc  &&
    make

To test the result, issue as the `root` user: make check. Some tests will fail if appropriate kernel configuration options are not set. Some additional options that may be needed for tests are:

    CONFIG_SCSI_LOWLEVEL,
    CONFIG_SCSI_DEBUG,
    CONFIG_BLK_DEV_DM_BUILTIN,
    CONFIG_CRC_T10DIF,
    CONFIG_CRYPTO_USER,
    CONFIG_CRYPTO_CRYPTD,
    CONFIG_CRYPTO_LRW,
    CONFIG_CRYPTO_XTS,
    CONFIG_CRYPTO_ESSIV,
    CONFIG_CRYPTO_AES_TI,
    CONFIG_CRYPTO_AES_NI_INTEL,
    CONFIG_CRYPTO_BLOWFISH,
    CONFIG_CRYPTO_CAST5,
    CONFIG_CRYPTO_SERPENT,
    CONFIG_CRYPTO_SERPENT_SSE2_X86_64,
    CONFIG_CRYPTO_SERPENT_AVX_X86_64,
    CONFIG_CRYPTO_SERPENT_AVX2_X86_64, and
    CONFIG_CRYPTO_TWOFISH_X86_64

Now, as the `root` user:

    make install

## Command Explanations

`--disable-ssh-token`: This switch is required if the optional libssh dependency is not installed.

`--disable-asciidoc`: This switch disables regeneration of the man pages. Remove this switch if you have asciidoctor-2.0.26 installed and wish to regenerate the man pages. Note that even if this switch is used, the pre-generated man pages are shipped in the tarball and they'll still be installed.

## Configuring cryptsetup

Because of the number of possible configurations, setup of encrypted volumes is beyond the scope of the BLFS book. Please see the configuration guide in the cryptsetup FAQ.

## Contents

Installed Programs: cryptsetup, integritysetup, and veritysetup
Installed Libraries: libcryptsetup.so
Installed Directories: /usr/lib/cryptsetup

### Short Descriptions

cryptsetup | is used to setup dm-crypt managed device-mapper mappings
integritysetup | is a tool to manage dm-integrity (block level integrity) volumes
veritysetup | is used to configure dm-verity managed device-mapper mappings. The Device-mapper verity target provides read-only transparent integrity checking of block devices using the kernel crypto API

- Prev

  CrackLib-2.10.3

- Next

  Cyrus SASL-2.1.28

- Up
- Home