A long time user of GnuPG, I was interested to learn about Cryptoloop, which offers full filesystem encryption, making it easier to edit secrets in place.

1 The Kernel Module

Cryptoloop is a kernel module which may not necessarily be inserted by default. It is provided in Debian systems in a package called along the lines of loop-aes-utils. Once installed, you can simply add the module to the kernel as root by running:

modprobe cryptoloop

2 Making the Encrypted Filesystem

Cryptoloop can be used to encrypt filesystems located on entire partitions. However, it also works with loop devices, an approach adding a lot of flexibility if you want to isolate your encrypted filesystems, or if you like working with small ones which you can securely copy to other media.

1. Create the file that will contain the filesystem. Adding random data from /dev/urandom further enhances security by making it harder for attackers to break in:

   dd if=/dev/urandom of=encryptedfs count=1000

2. Set up the loop device:

   losetup -e aes-256 /dev/loop0 encryptedfs

   You'll be asked for a passphrase at this stage.

3. Create the filesystem:

   mkfs.ext3 /dev/loop0

4. Detach the loop device:

   losetup -d /dev/loop0

3 Mounting and Unmounting the Encrypted Filesystem

You may now mount your filesystem with mount, without needing to play with loop devices anymore. Interestingly, no option -o loop is required either, even though it's a loop device. However, you may still need to add the cryptoloop module, if you haven't done so already since the last reboot. You'll be asked for a password upon mount:

mount -o encryption=aes-256 encryptedfs mountpoint

Unmounting the filesystem is carried out without any particular option:

umount mountpoint

4 References

• Cryptoloop HOWTO