In this video we'll discuss full disk encryption using dm-crypt and luks. Mobile devices such as mobile
phones, tablets and laptops or even USB sticks have the unfortunate property of being lost or stolen
easily.
This can be disastrous for a company if a device is lost or stolen while containing sensitive information
like intellectual property. According to different statistics between 40-50 percent of breaches occurred
due to stolen laptops or other storage devices.
Just because a laptop are password protected, files are not necessarily safe from unauthorized
access.
Hackers can easily boot the computer from a USB drive and then access all the files on the computer.
As I suppose you already know there are a lot of ways of recovering the root or admin password. HTTPS,
SSH and other encrypted protocols protect data that’s in transit across across the network while full disk
encryption, also known as data at rest protection, protects data that’s at rest on disk. Full disk encryption
also differs from file encryption in that the later only encrypts the individual files you specify for
encrypting. Full disk encryption is a cryptographic method that applies encryption to the entire hard
drive including, files, the operating system and software programs.
In this lecture I'll show you how to fully encrypt your drive partitions using dm-crypt and LUKS
which is the standard for encrypting disks on Linux. dm-crypt is a feature rich and very efficient in
terms of resource consumption.
It can also be configured to encrypt to encrypt RAID volumes and LVM physical volumes. Dm- crypt is a kernel-
level encryption mechanism which offers transparent disk encryption.
This means that the files are immediately available without any additional interaction after mounting.
I myself for example have a very large external hard drive and use it to back up all my professional
and personal information.
It's encrypted using dm-crypt and luks which is extremely secure
and if I lose it or gets stolen no one can access my private photos or documents. A common concern surrounding
full disk encryption is the fear that the encryption and decryption process will cause a noticeable
slowdown of processor speeds.
It’s not the case with new hardware and dm-crypt. dm-crypt and LUKS also offer plausible deniability
which is an important concept when it comes to disk encryption.
In short it means that you can do or have something and nobody can suspect or prove that
(if you don't admit it, of course). And then you can deny having or doing that thing,
if someone wants to accuse you, because (let's repeat it) nobody can prove it.
In case of disk encryption the plausible deniability property means that if you have an encrypted disk
no one can prove that's encrypted,
of course if you don't admit it and asa logical consequence you cannot be forced to decrypt that
disk. dm-crypt is the kernel module used for encryption.
But what is LUKS? LUKS is short for ”Linux Unified Key Setup” and has been invented to standardize
key setup while most disk encryption software implements different incompatible formats LUKS implements
a platform-independent standard on-disk format for use in various tools. With LUKS all information like
the master encryption key or headers needed for the encryption are saved on the partition that's encrypted.
Okay.
This was a short introduction to full disk encryption using dm-crypt and LUKS. Also note that this is
a Linux solution; in the following lecture
I'll show your live how to set up an encrypted USB stick.
See you in a second!