{
  "slug": "inline-encryption",
  "term": "Inline encryption",
  "aliases": [
    "Linux blk-crypto"
  ],
  "definition": "Inline encryption is per-I/O encryption in the storage path, controlled by a key, algorithm, data-unit size and data-unit number.",
  "note": "Linux v6.12 carries an encryption context with block I/O and manages hardware capabilities and keyslots. Unlike a memory crypto accelerator, the hardware processes storage requests; unlike a self-encrypting drive, it exposes per-request cryptographic control. [inline-source]\n\nThe optional blk-crypto-fallback backend uses the kernel crypto API. For identical input and encryption parameters, correct implementations produce the same on-disk ciphertext, so the execution backend is distinct from the file format. [inline-source]\n\nThe documented lifecycle separates completion, eviction and zeroization. Only after all I/O completes should a caller evict the key from each block device using it, then zeroize the key object. Releasing a request's keyslot reference is not the entire lifecycle. [inline-source]",
  "status": "shipping",
  "advantages": [],
  "limitations": [
    {
      "text": "Support through blk-crypto does not itself prove hardware offload or authenticated encryption.",
      "citationIds": [
        "inline-source",
        "fscrypt-source"
      ]
    }
  ],
  "related": [
    "fscrypt",
    "self-encrypting-drive",
    "ufs",
    "xts-aes",
    "cryptographic-erase"
  ],
  "supersedes": [],
  "supersededBy": [],
  "firstSeen": null,
  "lastSeen": null,
  "citations": [
    {
      "id": "inline-source",
      "title": "Linux v6.12: inline encryption, block-I/O contexts and software fallback",
      "url": "https://docs.kernel.org/6.12/block/inline-encryption.html",
      "accessed": "2026-10-22"
    },
    {
      "id": "fscrypt-source",
      "title": "Linux v6.12: fscrypt, encryption modes and inline encryption support",
      "url": "https://docs.kernel.org/6.12/filesystems/fscrypt.html",
      "accessed": "2026-10-22"
    },
    {
      "id": "hesela-fscrypt",
      "title": "Hesela: filesystem encryption and the execution backend",
      "url": "https://hesela.com/analyses/checksums-identity-and-lost-writes/#filesystem-encryption",
      "accessed": "2026-10-22"
    }
  ],
  "updated": "2026-10-22"
}