{
  "slug": "dm-crypt",
  "term": "dm-crypt",
  "aliases": [],
  "definition": "dm-crypt is a Linux device-mapper target that transparently encrypts and decrypts block-device I/O using the kernel cryptographic API.",
  "note": "The target is distinct from LUKS metadata and from the userspace cryptsetup utility. Its selected cipher and integrity configuration determine the protection. Linux v6.12 ignores discard by default; allow_discards forwards it and may expose allocation information if discarded ranges can later be identified. [dm-crypt-source]",
  "status": "shipping",
  "advantages": [],
  "limitations": [
    {
      "text": "An encryption mapping is not evidence that authentication is enabled.",
      "citationIds": [
        "dm-crypt-source",
        "cryptsetup-source"
      ]
    }
  ],
  "related": [
    "luks",
    "xts-aes",
    "authenticated-encryption",
    "dm-integrity",
    "discard",
    "block-storage"
  ],
  "supersedes": [],
  "supersededBy": [],
  "firstSeen": null,
  "lastSeen": null,
  "citations": [
    {
      "id": "dm-crypt-source",
      "title": "Linux v6.12: dm-crypt, encryption target, integrity metadata and allow_discards",
      "url": "https://docs.kernel.org/6.12/admin-guide/device-mapper/dm-crypt.html",
      "accessed": "2026-10-15"
    },
    {
      "id": "cryptsetup-source",
      "title": "cryptsetup v2.8.1: LUKS extension and experimental authenticated disk encryption",
      "url": "https://gitlab.com/cryptsetup/cryptsetup/-/raw/v2.8.1/man/cryptsetup.8.adoc",
      "accessed": "2026-10-15"
    },
    {
      "id": "hesela-encryption",
      "title": "Hesela: Encryption is not authentication",
      "url": "https://hesela.com/analyses/checksums-identity-and-lost-writes/#encryption-boundaries",
      "accessed": "2026-10-15"
    }
  ],
  "updated": "2026-10-15"
}