Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am looking for strong cipher for LUKS, currently I am thinking about SHA512, but encryption is not my cup of tea, so could you give me your hints, what are you using for encryption?

share|improve this question
SHA512 is rather too one-wayish for a crypto cipher... – Hubert Kario Jan 8 '11 at 18:53
What is your use case? What kind of data are you trying to protect, what are you trying to protect against, and are there any applicable legal/regulatory compliances involved? – Scott Pack Jan 8 '11 at 19:26
Ency, I don't know what country you are in, but in the US (and several others), a Court can order you to turn over your encryption keys and or passwords, and basically keep you in jail until you do. Just an FYI. – BenGC Jan 8 '11 at 19:55
@zoredache: Since he is most likely trying to commit crimes (i.e. obstruct legal investigations and court orders) we probably shouldn't help him there either. – Scott Pack Jan 8 '11 at 20:35
@packs: You and everyone else has a right on privacy (or are you from china or kldr?) and that's what i want to have, no one is able to see may data without may permission. – Ency Jan 8 '11 at 21:29
up vote 7 down vote accepted

Go with the default unless you know what you're doing.

share|improve this answer
I know what I am doing, I am just not so good in cryptography, that is why i am asking ... – Ency Jan 8 '11 at 20:31
I believe the default for LUKS is AES-CBC with a 256 bit key size. This is a pretty good all around choice. As mentioned unless you know more about cryptography than the developers of LUKS, staying with the default is probably a good choice. – kce Jan 8 '11 at 21:00
Cryptography is hard, really hard. The key strength, algorithm, use case, and cipher mode need to all fit together like a puzzle, or else the whole is weaker than the sum. Unless you have a strong understanding of all those parts, then the defaults are usually better. That being said, AES-CBC with a 256 bit key sounds reasonable from my understanding of them. – Scott Pack Jan 9 '11 at 15:50

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.