Cryptoloop can be used either on a file or an entire file system. The following describes how to set it up on a particular partition. This partition can be any partition you like; the following example uses /dev/sda1. I have chosen to use AES as a cipher, but you can substitute any cipher you like that has been enabled in the kernel. You can get a list of the algorithms supported by your currently running kernel by looking into /proc/crypto. An excellent resource, discussing the different cryptographic algorithms, are Bruce Schneier's books, Applied Cryptography and Practical Cryptography. Both AES and Serpent are probably a reasonable choice. AES has been cryptanalyzed a lot and no serious weaknesses have been discovered so far. Serpent has not been analyzed as much, but is considered to be even a little bit stronger than AES. However, Serpent is also slower than AES. Stay away from DES, it is both slow and weak. Triple-DES may be an option, but AES is probably more secure and faster, so there is really no reason to use Triple-DES anymore.
It is recommended that you format your partition and fill it with random data before you create the encrypted file system on it. This will make it harder for an attacker to detect patterns in your encrypted partition.
WARNING!
Be careful what you type here for your partition. If you do make a mistake, you can easily overwrite the wrong partition with random garbage!
Filling a partition with random data can be done as follows:
dd if=/dev/urandom of=/dev/sda1 bs=1M |
You may get an error message that the device is full. You can ignore it.
Select a cipher and key size. A list of ciphers supported by your kernel can be obtained from /proc/crypto. I recommend that you use AES with a 256-bit key.
Set up the loop device. This is done using the losetup command from the util-linux package. The following command creates an encrypted filesystem using the loop device 0 using the AES cipher with a 256-bit key on the device /dev/sda1:
losetup -e aes-256 /dev/loop0 /dev/sda1 |
The command prompts for a password. Select a strong password and try to remember it without having to stick a Post-It note to your monitor. There is one big downside to using Cryptoloop. Since the password is hashed to create the encryption key, it is not easy to change the password later on. The most straight-forward way of changing the password is to create a new encrypted partition or file and move all data into it. For this reason, make sure you select a strong password from the start. AES may be a strong algorithm, but if you chose a weak password, that security goes down the drain.
If losetup fails with an INVALID ARGUMENT error message, there is a problem with your util-linux package. Make sure you have followed the instructions above on how to install a patched version of util-linux. Older and unpatched version use a different way of passing the key size, and do not work with the 2.6 Crypto API.
Create a file system. You can chose whatever file system you like. The following creates an ext3 file system using the loop device:
mkfs.ext3 /dev/loop0 |
Mount the encrypted file system. First you need to create a mount point, such as /mnt/crypto:
mkdir /mnt/crypto |
Then you need to mount the file system. At this stage you need to tell mount explicitly which loop device to use:
mount -t ext3 /dev/loop0 /mnt/crypto |
You can now play with your encrypted file system until you are bored.
Unmount the file system. After you are done playing, unmount the filesystem:
umount /mnt/crypto |
Detach the loop device. The loop device is still attached to your partition. Detach it with:
losetup -d /dev/loop0 |