Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

When I read the manpage for cryptsetup on Linux about "Plain mode" it says:

Plain dm-crypt encrypts the device sector-by-sector with a single, non-salted hash of the passphrase.

and the -c option says:

--cipher, -c <cipher-spec>
   Set the cipher specification string.

   cryptsetup  --help shows the compiled-in defaults.  The current default in the distrib‐
   uted sources is "aes-cbc-essiv:sha256" for both plain dm-crypt and LUKS.

Question

Does aes-cbc-essiv:sha256 mean that for each sector of my harddrive a sha256 hash of the passphrase is also stored in the sector?

If that is the case: What is the purpose of storing the hashed passphrase so many times?

share|improve this question
add comment

1 Answer

up vote 2 down vote accepted

You quoted part of the man page - out of context.

Let's look at it in context:

Plain dm-crypt encrypts the device sector-by-sector with a single, non-salted hash of the passphrase. No checks are performed, no metadata is used. There is no formatting operation.

Nothing but the encrypted data is stored when using plain dm-crypt.

P.S. Don't use plain dm-crypt. The reasons why are at the very top of the same man page.

share|improve this answer
    
I think there is more than one meaning of "plain". There is use header yes/no plain/luks. You can e.g. give these arguments to cryptsetup -c aes-cbc-plain -s 256, -c aes-cbc-benbi -s 256, -c aes-cbc-null -s 256. I suppose that "plain" has something to do with each sector? –  Sandra Dec 27 '12 at 2:38
    
Your choice of cipher has nothing to do with whether you choose to use dm-crypt or LUKS. –  Michael Hampton Dec 27 '12 at 2:43
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.