dm-crypt · shipping

dm-crypt

dm-crypt is a Linux device-mapper target that transparently encrypts and decrypts block-device I/O using the kernel cryptographic API.

Related Observatory article: dm-crypt on hesela.com

The target is distinct from LUKS metadata and from the userspace cryptsetup utility. Its selected cipher and integrity configuration determine the protection. Linux v6.12 ignores discard by default; allow_discards forwards it and may expose allocation information if discarded ranges can later be identified. [1]

Relations

related

luks, xts-aes, authenticated-encryption, dm-integrity, discard, block-storage

Limitations

• An encryption mapping is not evidence that authentication is enabled. [1, 2]

Citations

1. Linux v6.12: dm-crypt, encryption target, integrity metadata and allow_discards (accessed 2026-10-15)
2. cryptsetup v2.8.1: LUKS extension and experimental authenticated disk encryption (accessed 2026-10-15)
3. Hesela: Encryption is not authentication (accessed 2026-10-15)

JSON: /data/terms/dm-crypt.json