Disk encryption in Mandriva

Last weekend, I bough an external USB hard drive to finally start regularly making back-ups of my computers at home. For security reasons, I wanted to store back-ups on an encrypted partition, because one never knows what may happen. Using an encrypted partition was not too hard, but still some bugs prevented it from being newbie proof.

For the encrypted partition, I chose to use LUKS. It seems to be some kind of standard, widely supported (by Hal for example), and it has some graphical utilities available which should make it a no-brainer.

First problem, I’m using x86_64, and apparently luks-tools only exists for i586 in Mandriva. I filed a bug, and a new luks-tools package for x86_64 should already appear very shortly on a Cooker mirror near you. If you have luks-tools installed, it should be as simply as running gnome-luks-format to set up an existing partition.

So I did it at the console. Of course, make sure you have the package cryptsetup installed, otherwise you won’t have the necessary utilities. First we’ll add a header to the partition, indicating that this is a LUKS encrypted partition, and which encryption type we are using:

cryptsetup -c aes-cbc-essiv:sha256 luksFormat /dev/sdb1

(as I already mentioned with gnome-luks-format, you should create the partition first, for example with diskdrake or cfdisk).
Once the header is in place, we’ll open the encrypted partition:

cryptsetup luksOpen /dev/sdb1 encbackup

Encback is a name you can freely replace by your own choice of course. Once you have done this, your encrypted partition will be mapped to /dev/mapper/encback. You can use this like any normal partition for example to create an ext3 file system on it:

mkfs.ext3 /dev/mapper/encback

Then we can mount it:

mount /dev/mapper/encback /media/encrypted-backup

And we’re ready to go. To close the encrypted device after I have umount it, I run

cryptsetup luksClose encback

When you plug in the USB disk, hall will automatically detect you have a LUKS encrypted partition. A dialog will appear, where you can enter your passphrase, and after that it is mounted automatically. At least, that’s the theory. Unfortunately, this was not working, probably because of bug #30015. Let’s hope this gets fixed soon! Also note that KDE does not seem to support this at all, so even then this is Gnome only. For now I have created two small scripts, which will run cryptsetup and mount or umount, so I don’t have to retype these commands by hand each time.

I opened another bug to request LUKS support in diskdrake. Disk encryption is becoming more and more common these days with all those portable storage media, so Mandriva’s default partition tool should have this support built in. I guess it should not be too hard to implement this.

Some nice documentation which helped me a lot during this exploration, can be found in Red Hat Magazine.

Update 22 May 2007: I updated the howto to use aes-cbc-essiv:sha256 instead of aes-cbc-plain. Reader David Crick pointed me to the fact that aes-cbc-plain is vulnerable to a cryptography weakness, which is called the “watermarking attack”. Thanks!