NOTE
If the encryption is not required to be deniable, it is safer and more convenient to use LUKS, instead.
This documentation contains instructions to use dm-crypt's plain-mode feature to achieve deniable encryption on Linux-based systems, without the use of third-party tools such as VeraCrypt.
Unlike Linux Unified Key Setup (LUKS), there is no header with plain mode; this is what gives plain mode its deniability aspect. This comes with advantages, including the difficulty, if not impossibility, of discovering that encrypted data exists, at all. However, it also comes with disadvantages, such as requiring the full commands to be entered every time the user wishes to open and use a plain-mode-encrypted device, the inability to use a Key Derivation Function (KDF), and the inability to change the encryption options or passphrase without losing the already-encrypted data (backing-up to another device is required to avoid data-loss in such a scenario).
|
NOTE |
If the encryption is not required to be deniable, it is safer and more convenient to use LUKS, instead. |
Within this documentation, # is used to denote running the command as the root user, and
$ is used to denote running the command as an unprivileged user. The lowest-privileged user
able to run the commands will be used for each command. Some shells may present different characters for
privileged and unprivileged users than used in this documentation; the shell's documentation should be
consulted if this is true for the system being used.
For the complete dm-crypt plain-mode documentation, consult the manpage via
man cryptsetup.
A block device is any disk, partition, or file, which can be used to store arbitrary data; it is not limited to physical disks.
Before proceeding with encryption, it is recommended that the block device be filled with random data. While this is not a requirement, it substantially increases the deniability of the encryption, due to looking like random data from beginning to end, regardless of whether it contains data or not.
In order to fill a hard-disk drive (HDD) with random data, the entire disk can be overwritten
with data from /dev/urandom; an example tool to use for this is dd, via the following
command:
# dd if=/dev/urandom of=<block device>
For rewritable optical discs (including CD-RW, DVD-RW, DVD+RW, DVD-RAM, and BD-RE), the disc should be filled with random data before beginning.
Recordable optical discs (including CD-R, DVD-R, DVD+R, and BD-R) do not require overwriting as they are already blank and cannot be reused after being written to.
|
NOTE |
It is not recommended that flash storage be overwritten, rather sanitized of old data, given the methods in which flash storage writes to cells and typically has overprovisioned storage. Overwriting flash storage, or files stored on flash storage, is a complicated topic with many obstacles to achieving guaranteed removal of previous data. Given the varying implementations of flash-storage overwriting tools, only a basic guide can be given. For later NVMe SSDs, there are official sanitize commands mandated by the specification. For SATA SSDs, Secure Erase functionality has been proven to be poorly implemented in a lot of drives, so using a new drive is recommended. |
CAUTION |
If the user is in doubt about whether sensitive data has leaked prior to switching to dm-crypt's plain-mode encryption, and they are also in doubt about whether it can be securely erased, the disk should be physically destroyed and a new one used. |
In dm-crypt terminology, a device is a block device which has been opened with a dm-crypt mapping and is ready for use.
Unlike LUKS, plain mode does not require formatting the block device before use. Plain mode works
by writing raw data directly to the sectors of the block device via its mapped device, located
within /dev/mapper/, as follows:
Plaintext (in memory) -> dm-crypt device (plaintext encrypted to ciphertext) -> block device (ciphertext stored)
If data exists on the underlying block device which has been opened, it will be silently overwritten by plain mode as data is written to disk. Data is written on-the-fly, so solely opening a device without writing to it does not destroy existing data on the block device.
WARNING |
It is imperative that shell logging be disabled while opening a plain-mode device,
whether by disabling shell history, sending it to |
To open a dm-crypt plain-mode device, the following command is used:
# cryptsetup open --type plain --cipher <cipher> --key-size <key size> --hash <hash> <block device> <device name>
-M can be as the short-form variant of --type, -c can be
used as the short-form variant of --cipher, -s can be used as the
short-form variant of --key-size, and -h can be used as the short-form
variant of --hash.
Optical discs cannot be directly opened. In order to create a dm-crypt plain-mode device on an optical disc, a new file should be created via a tool such as fallocate, via the following command:
$ fallocate -l <file size> <filename>
After the file has been created, it should be mounted to a loopback device
(/dev/loopn) and the following steps performed on that device. Once all
steps have been completed, the file should be burned to the disc as a disc image.
For maximum security, it is recommended to use AES-XTS (aes-xts-plain64) as the
cipher, 512-bits (512) as the key size (XTS mode splits the key size, making 512 bits =
256 bits, and 256 bits = 128 bits), and SHA-512 (sha512) as the hash.
At this point, the user will be prompted to enter a passphrase. This passphrase will be used alongside the encryption options to encrypt data in an on-the-fly manner to the block device as it passes through the dm-crypt device.
|
CAUTION |
Once a dm-crypt plain-mode device has been opened, the encryption options and passphrase cannot be changed without data loss. Should changing the encryption options and/or passphrase be required for already-encrypted data, the data should be moved or copied from the dm-crypt device, the dm-crypt device should be closed, then the dm-crypt device reopened with different encryption options and/or a different passphrase before the data is moved or copied back to it. |
|
WARNING |
Due to lack of a header, dm-crypt makes no attempt to verify whether the encryption options or passphrase match on opening a dm-crypt device. Failure to use the same encryption options and passphrase on successive device openings will result in irrecoverable loss of all data encrypted while the dm-crypt device was previously opened! |
The dm-crypt device can now be located at /dev/mapper/<device>, be
formatted with the user's filesystem of choice, and be mounted at the user's mountpoint of
choice.
If the user requires deniable encryption and their threat model does not include being coerced to open the device or hand over the passphrase, it is safe to skip to the Close dm-crypt Device section; otherwise, continue to the Using dm-crypt Offsets section.
Using a single layer of deniable encryption in a situation in which the user is required to either open the device or hand over the passphrase is useless; however, dm-crypt has a solution to this problem.
When opening a dm-crypt device, the user may specify the --offset option
(-o as the short-form variant) to begin the encryption and decryption processes at an
offset on the block device. This allows the user to nest dm-crypt devices within one another and
potentially add decoy data to the first device in the nest prior to the offset.
Offsets are input as an option to the command found in the above section, as follows:
--offset <sectors>
The number of sectors determines where the beginning of the dm-crypt device is in relation to the beginning of the sectors on the block device or higher-level dm-crypt device.
As stated above, it is possible to nest dm-crypt devices within one another. This is achieved by
opening the first dm-crypt device which already exists within /dev/mapper/, with an
offset, as follows:
# cryptsetup open --type plain --offset <sectors> --cipher <cipher> --key-size <key size> --hash <hash> /dev/mapper/<device> <device name>
At this point, the user will be prompted to enter a passphrase. This passphrase should be different to the passphrase for the higher-level dm-crypt devices in order to add a security advantage of using a unique key, rather than relying solely on obscurity of the adversary not knowing the offset amount.
The user will see the nested dm-crypt device contained within the higher-level dm-crypt device.
In the following example of lsblk, device-0 is the first-level dm-crypt
device, which was opened from block device /dev/sda without an offset, and
device-1 is the nested dm-crypt device, which was opened from device-0
with an offset:
sda └─device-0 └─device-1 sdb nvme0n1 nvme1n1
The other block devices shown in this example are for visual purposes, only, to show a more-likely real-world output.
|
NOTE |
Multiple dm-crypt devices can be nested inside of others in a mix-and-match fashion to suit the requirements of the user. It is recommended to not make the mappings more complicated than they have to be, in order to reduce the risk of data-loss, and confusion which could lead to loss of deniability. |
|
CAUTION |
It is possible to write data to the higher-level dm-crypt devices as decoy data. Should the user decide to do this, they should be sure not to write data into the beginning sectors of the offset; otherwise, they will write over the real data stored within the offset. |
|
CAUTION |
Given the fact that optical discs have either a lead-out section or visible burned-data markings on the physical disc, or both, it may be better to either write only a small amount of deniable data to the disc, with a larger amount of decoy data prior to the offset, or fill the rest of the disc image with random data before burning. This should be considered before burning the data to disc. Which method to use is left to the discretion of the user and their threat model. |
In order to close an opened dm-crypt device, it should be unmounted (if the device is mounted), then the following command should be run:
# cryptsetup close <device>