LUKS & dm-crypt Encryption

Full-disk and partition encryption with dm-crypt and LUKS2, key management, TPM2 unlocking, and Kubernetes encrypted volumes.

Overview

dm-crypt is the Linux kernel's transparent block device encryption layer, built on the Device Mapper framework. LUKS (Linux Unified Key Setup) is the metadata format layered on top that manages key slots, algorithm parameters, and header backup.

LUKS2 Improvements over LUKS1

Argon2id KDF (key derivation function) — memory-hard, GPU-resistant (vs PBKDF2 in LUKS1)
JSON metadata — extensible header, supports labels and tokens
32 key slots (vs 8 in LUKS1)
Token plugins — TPM2, FIDO2, Clevis for automated unlocking

Automatic Unlocking with TPM2

Clevis + Tang implement Network Bound Disk Encryption (NBDE): the encryption key is sealed in the TPM2 chip and only released if the system boots in a known-good state (PCR measurements match). Useful for auto-unlock after reboot without human intervention.

Key concepts

Key slot: LUKS stores the master key encrypted with up to 32 different passphrases/keys. Each is a separate key slot. Revoking a key slot does not require re-encrypting data.
Argon2id: Memory-hard KDF used in LUKS2. Increases GPU/ASIC brute-force cost by requiring large amounts of RAM. Configurable memory and iteration count.
dm-crypt: Kernel Device Mapper target that performs AES-XTS-256 encryption transparently. All reads/writes to the mapped device are automatically decrypted/encrypted.
NBDE (Network Bound Disk Encryption): Clevis + Tang: disk auto-unlocks only when the server can reach a Tang key server on a trusted network, preventing decryption if a disk is stolen offline.

When to use it

Designing at-rest encryption for cloud VM data disks and Kubernetes PVs
Explaining TPM2-based automated disk unlock for server reboots without human passphrase
Auditing storage security for compliance (PCI-DSS, HIPAA) requirements

Interview questions

How do you set up full-disk encryption on a Linux data disk, and how would you enable automatic unlocking on reboot for a server?