admin-guide/device-mapper/dm-crypt.rst

2 dm-crypt
5 Device-Mapper's "crypt" target provides transparent encryption of block devices
21        cipher[:keycount]-chainmode-ivmode[:ivopts]
25        aes-cbc-essiv:sha256
26        aes-xts-plain64
27        serpent-xts-plain64
30     format (selected by capi: prefix). The IV specification is the same
36         capi:cipher_api_spec-ivmode[:ivopts]
40         capi:cbc(aes)-essiv:sha256
41         capi:xts(aes)-plain64
45         capi:gcm(aes)-random
46         capi:authenc(hmac(sha256),xts(aes))-random
47         capi:rfc7539(chacha20,poly1305)-random
55     You can only use key sizes that are valid for the selected cipher
56     in combination with the selected iv mode.
70     Either 'logon', 'user', 'encrypted' or 'trusted' kernel key type.
77     Multi-key compatibility mode. You can define <keycount> keys and
117     Set dm-crypt workqueues and the writer thread to high priority. This
118     improves throughput and latency of dm-crypt while degrading general
130     Bypass dm-crypt internal workqueue and process read requests synchronously.
133     Bypass dm-crypt internal workqueue and process write requests synchronously.
134     This option is automatically enabled for host-managed zoned block devices
135     (e.g. host-managed SMR hard-disks).
138     The device requires additional <bytes> metadata per-sector stored
139     in per-bio integrity structure. This metadata must by provided
140     by underlying dm-integrity target.
151     This option can be in range 512 - 4096 bytes and must be power of two.
171       is received, dm-crypt will split the request. The splitting improves
173       cores), but it also causes overhead. The user should tune this parameters to
178       is received, dm-crypt will split the request. The splitting improves
180       cores), but it also causes overhead. The user should tune this parameters to
187 encryption with dm-crypt using the 'cryptsetup' utility, see
194 …dmsetup create crypt1 --table "0 `blockdev --getsz $1` crypt aes-cbc-essiv:sha256 babebabebabebabe…
200 …dmsetup create crypt2 --table "0 `blockdev --getsize $1` crypt aes-cbc-essiv:sha256 :32:logon:my_p…