=== Introduction ===
LUKS (Linux Unified Key Setup) volume encryption is used for all disks
connected to CAcert servers. Generic information about LUKS can be found at
http://code.google.com/p/cryptsetup/.

=== Encryption at system installation time ===
When installing a new operating system on a disk, encryption must be setup
during that installation. Debian GNU/Linux 4.0 (Etch) allows for this. The
following choices should be made during the installation process:
 * Partition disks: Guided - use entire disk and setup encrypted LVM
 * Partitioning scheme: All files in one partition (recommended for new users)
 * Really use block device encryption? Yes
 * Encryption passphrase: use a secure passphrase unique for each disk
The passphrase should not be recorded in any digital system, but only written
down on paper and given out to critical system administrators only. One copy
should be given to CAcert Board for escrow purposes.

=== Encryption of additional system disks ===
When adding an extra disk to a system, encryption must be setup before putting
data on the disk. The following procedure can be followed:
 1. partition the disk:
  a. if the disk is never to be used for booting, create a single large data partition
  a. if the disk needs to be bootable, create one small boot partition (which will not be encrypted), and one large data partition (which will be encrypted)
 1. measure speed for randominzing 100 MB of the disk:
 {{{
  # dd if=/dev/urandom of=/dev/hdc5 bs=1024k count=100
 }}}
 1. initialize the large data partition (assume its name is /dev/hdc5) with random data:
 {{{
  # dd if=/dev/urandom of=/dev/hdc5 bs=1024k
 }}}
 1. this will take a very long time, you can calculate from the size of the disk and the timing above how long; measured on 172.28.50.6 has been 1.689 MB/sec, i.e. ~53 hours for 320 GB)
 1. (you can inspect the progress by a kill -USR1 pid-of-dd-process)
 1. (NOTE: there should be a faster way to do this, since the Debian installer can do it faster; need to investigate how it does it)
 1. initialize LUKS on the large data partition:
 {{{
   # cryptsetup luksFormat /dev/hdc5
 }}}
    (will prompt twice for passphrase, use the passphrase of hda5)
 1. open the large data partition through LUKS:
 {{{
   # cryptsetup luksOpen /dev/hdc5 hdc5_crypt
 }}}
    (will prompt again for passphrase)
 1. add the new encrypted partition to /etc/crypttab:
 {{{
   # vi /etc/crypttab
 }}}
    add a line for hdc5_crypt similar to the line for hda5_crypt, so the result becomes:
 {{{
     hda5_crypt /dev/hda5 none luks
     hdc5_crypt /dev/hdc5 none luks
 }}}
 1. now you can use LVM to use the encrypted partition in any way desired, e.g.
 {{{
   # pvcreate /dev/mapper/hdc5_crypt
   # vgcreate newvg /dev/mapper/hdc5_crypt
   # lvs
   # lvcreate -n newvol -L 200G newvg
   # pvs; vgs; lvs
   # mke2fs -j /dev/mapper/newvg-newvol
 }}}
 

=== Other notes ===

 * general user page: [[HardDriveEncryption]].
 * from cryptogram 20090215:  ''There's a new hard drive encryption standard, which will make it easier for manufacturers to build encryption into drives.  Honestly, I don't think this is really needed.  I use PGP Disk, and I haven't noticed any slowdown due to having encryption done in software.  And I worry about yet another standard with its inevitable flaws and security vulnerabilities.''
   * http://www.computerworld.com/action/article.do?command=viewArticleBasic&taxonomyName=storage&articleId=9126869&taxonomyId=19&intsrc=kc_top or http://tinyurl.com/dgrton
   * http://arstechnica.com/hardware/news/2009/01/hard-drive-manufacturers-unveil-disk-encryption-standard.ars or http://tinyurl.com/a9qn7p
   * http://www.theregister.co.uk/2009/01/30/tcg_encryption_standards/
   * ''Perceptive comment about how the real benefit is regulatory compliance:'' http://www.schneier.com/blog/archives/2009/02/hard_drive_encr.html#c347372 or http://tinyurl.com/c8qegx
 * also from cryptogram 20090215:  ''The Doghouse: Raidon's Staray-S Encrypted Hard Drives. Turns out the algorithm is linear.''
   * http://www.heise-online.co.uk/security/Cracking-budget-encryption--/features/112548 or http://tinyurl.com/ctbquo
   * ''When you're buying security products, you have to trust the vendor. That's why I don't buy any of these hardware-encrypted drives. I don't trust the vendors.''

----
CategoryProcedures