That's OK. But, what are the most secure cryptsetup parameters to use? E.g.: "aes-cbc-essiv:sha512" is better then the default. Also the default cryptsetup uses 256bit AES, but it could be (max?) 512bit. Which parameters create an encrypted partition with the most security?
closed as not a real question by Gilles, Michael Mrozek♦ May 22 '11 at 3:08
It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.
Hiding the fact that you are using encryption is very hard. Consider that some minimal decryption software (like in initrd) must be stored in plain text somewhere. Seeing that and a disk full of random data people might find out.
If you can't prevent that you might as well take advantage of LUKS. For example if you have multiple users they can have their own password.
About the cipher modes and algorithms. AES is the most widely used algorithm and it supports 128, 192 and 256 bit keys. None of them are even close to being broken. CBC means cipher block chaining. It should not be used for disk encryption because it is vulnerable to watermarking. Use the XTS mode instead. Essiv means that the IV is secret too. This also prevents watermarking. SHA512 is a hashing algorithm used to generate the encryption key from the password. It is considered secure.
You may want to look at loop-aes. It has no header, uses multiple 64x256 bit keys and you can use an external disk (like a pendrive) for storing the keys encrypted with your password. Unfortunately it requires kernel patching.
BTW I agree with the comments. There is no most secure way. Think about what are you trying to protect and what kind of attacks do you expect.