Using a liveCD.

Benchmark says the fastest disk IO on my notebook will be: aes-xts 256b

root@ubuntu:~# cryptsetup benchmark
# Tests are approximate using memory only (no storage IO).
PBKDF2-sha1      1008246 iterations per second
PBKDF2-sha256     615361 iterations per second
PBKDF2-sha512     458293 iterations per second
PBKDF2-ripemd160  585142 iterations per second
PBKDF2-whirlpool  215578 iterations per second
#  Algorithm | Key |  Encryption |  Decryption
     aes-cbc   128b   517.0 MiB/s  2130.7 MiB/s
 serpent-cbc   128b    69.3 MiB/s   240.2 MiB/s
 twofish-cbc   128b   157.3 MiB/s   294.5 MiB/s
     aes-cbc   256b   398.4 MiB/s  1785.7 MiB/s
 serpent-cbc   256b    70.4 MiB/s   234.5 MiB/s
 twofish-cbc   256b   158.3 MiB/s   290.5 MiB/s
     aes-xts   256b  1964.8 MiB/s  1968.9 MiB/s
 serpent-xts   256b   246.5 MiB/s   240.0 MiB/s
 twofish-xts   256b   290.2 MiB/s   293.9 MiB/s
     aes-xts   512b  1372.7 MiB/s  1403.4 MiB/s
 serpent-xts   512b   244.9 MiB/s   240.0 MiB/s
 twofish-xts   512b   272.5 MiB/s   296.2 MiB/s

my current settings for the LUKS device:

root@ubuntu:~# cryptsetup luksDump /dev/sda5
LUKS header information for /dev/sda5

Version:        1
Cipher name:    aes
Cipher mode:    xts-plain64
Hash spec:      sha256
Payload offset: 4096
MK bits:        512
MK digest:      48 86 e6 b3 6b 4c 4b 9e 2c ce ce ed c3 57 13 11 ab b4 fd 2d 
MK salt:        83 d4 35 64 d8 01 75 9d 58 76 8d 2e ac eb 3a 9c 
            a4 11 3b 9f f4 79 1d 56 5c 57 25 23 39 d8 b5 ab 
MK iterations:  80375
UUID:           df2f64fa-5bce-4d8c-9dcb-274435c8180a

Key Slot 0: ENABLED
    Iterations:             323231
    Salt:                   ca 08 b2 1b 43 a3 0f 41 df 3b 13 95 fa 80 03 33 
                        ba 28 70 a5 36 6f a2 0d 94 ae 25 55 ee 1b 62 b0 
    Key material offset:    8
    AF stripes:             4000
Key Slot 1: DISABLED
Key Slot 2: DISABLED
Key Slot 3: DISABLED
Key Slot 4: DISABLED
Key Slot 5: DISABLED
Key Slot 6: DISABLED
Key Slot 7: DISABLED

but when I try to set it for fast disk IO but slow brute-force attack speeds against the LUKS password (increasing iteration time to 10 seconds - according to the manpages, the default is 1 second):

root@ubuntu:~# cryptsetup-reencrypt /dev/sda5 -c aes-xts -s 512 -h sha512 -i 10000
WARNING: this is experimental code, it can completely break your data.
Enter passphrase for key slot 0: 
device-mapper: reload ioctl on  failed: Invalid argument
Activation of temporary devices failed.

It trashes my LUKS device:

root@ubuntu:~# cryptsetup luksDump /dev/sda5
Device /dev/sda5 is not a valid LUKS device.

Q: what am I missing?


Your live cd must be very old, regarding the warning message of cryptsetup-reencrypt. I used this tool many times, without any message or problems like this.

Also your command line is not correct, and must be changed from aes-xts to aes-xts-plain64.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.