Cryptoloop can be used either on a file or an entire file system. The following describes how to
set it up on a particular partition. This partition can be any partition you like; the following
example uses /dev/sda1. I have chosen to use AES as a cipher, but you can substitute any cipher
you like that has been enabled in the kernel. You can get a list of the algorithms supported by
your currently running kernel by looking into /proc/crypto. An excellent resource, discussing the
different cryptographic algorithms, are Bruce Schneier's books, Applied Cryptography and Practical
Cryptography. Both AES and Serpent are probably a reasonable choice. AES has been cryptanalyzed a lot
and no serious weaknesses have been discovered so far. Serpent has not been analyzed as much, but is
considered to be even a little bit stronger than AES. However, Serpent is also slower than AES.
Stay away from DES, it is both slow and weak. Triple-DES may be an option, but AES is probably more
secure and faster, so there is really no reason to use Triple-DES anymore.
It is recommended that you format your partition and fill it with random data before you create the encrypted file system on it. This will make it harder for an attacker to detect patterns in your encrypted partition.
WARNING!
Be careful what you type here for your partition. If you do make a mistake, you can easily overwrite the wrong partition with random garbage!
Filling a partition with random data can be done as follows:
dd if=/dev/urandom of=/dev/sda1 bs=1M
You may get an error message that the device is full. You can ignore it.
Select a cipher and key size. A list of ciphers supported by your kernel can be obtained from /proc/crypto. I recommend that you use AES with a 256-bit key.
Set up the loop device. This is done using the losetup command from the util-linux package. The following command creates an encrypted filesystem using the loop device 0 using the AES cipher with a 256-bit key on the device /dev/sda1:
losetup -e aes-256 /dev/loop0 /dev/sda1
The command prompts for a password. Select a strong password and try to remember it without having to stick a Post-It note to your monitor. There is one big downside to using Cryptoloop. Since the password is hashed to create the encryption key, it is not easy to change the password later on. The most straight-forward way of changing the password is to create a new encrypted partition or file and move all data into it. For this reason, make sure you select a strong password from the start. AES may be a strong algorithm, but if you chose a weak password, that security goes down the drain.
If losetup fails with an INVALID ARGUMENT error message, there is a problem with your util-linux package. Make sure you have followed the instructions above on how to install a patched version of util-linux. Older and unpatched version use a different way of passing the key size, and do not work with the 2.6 Crypto API.
Create a file system. You can chose whatever file system you like. The following creates an ext3 file system using the loop device:
mkfs.ext3 /dev/loop0
Mount the encrypted file system. First you need to create a mount point, such as /mnt/crypto:
mkdir /mnt/crypto
Then you need to mount the file system. At this stage you need to tell mount explicitly which loop device to use:
mount -t ext3 /dev/loop0 /mnt/crypto
You can now play with your encrypted file system until you are bored.
Unmount the file system. After you are done playing, unmount the filesystem:
umount /mnt/crypto
Detach the loop device. The loop device is still attached to your partition. Detach it with:
losetup -d /dev/loop0