mirror of
https://github.com/LCTT/TranslateProject.git
synced 2024-12-23 21:20:42 +08:00
Xingyu Wang
parent
06770bfeb0
commit
c3deff0eea
@ -0,0 +1,93 @@
|
||||
[#]: subject: "Linux Jargon Buster: What is LUKS Encryption?"
|
||||
[#]: via: "https://itsfoss.com/luks/"
|
||||
[#]: author: "Bill Dyer https://itsfoss.com/author/bill/"
|
||||
[#]: collector: "lkxed"
|
||||
[#]: translator: "ChatGPT"
|
||||
[#]: reviewer: "wxy"
|
||||
[#]: publisher: "wxy"
|
||||
[#]: url: "https://linux.cn/article-16068-1.html"
|
||||
|
||||
Linux 黑话解析：什么是 LUKS 加密？
|
||||
======
|
||||
|
||||
![][0]
|
||||
|
||||
> LUKS 是 Linux 用户中流行的磁盘加密机制。在这篇术语解析文章中，可以了解更多关于 LUKS 的信息。
|
||||
|
||||
计算机安全旨在保护私密信息。有许多方法可以保护系统。一些用户使用简单的用户名/密码登录方案进行基本保护。其他用户可能会通过加密以不同的方式增加额外的保护，如使用 VPN 和磁盘加密。
|
||||
|
||||
如果你的计算机上有敏感的客户数据（你可能在经营一家企业），或被视为知识产权的材料，或者你对隐私非常谨慎，你可能要考虑磁盘加密。
|
||||
|
||||
磁盘加密的一些好处包括：
|
||||
|
||||
- 保护系统免受黑客的攻击
|
||||
- 防止数据泄露
|
||||
- 保护你免受潜在的责任问题
|
||||
|
||||
磁盘加密软件可以防止台式机硬盘驱动器、便携式 USB 存储设备或笔记本电脑被访问，除非用户输入正确的身份验证数据。如果你的笔记本电脑丢失或被盗，加密会保护磁盘上的数据。
|
||||
|
||||
如今，新的 Windows 系统默认配备了 BitLocker 加密。在 Linux 上，LUKS 是最常用的磁盘加密方式。
|
||||
|
||||
想知道什么是 LUKS？我会为你简要介绍这个主题。
|
||||
|
||||
### 技术术语
|
||||
|
||||
在继续之前，需要定义一些术语。LUKS 有很多内容，因此将其拆解为细项将有助于你进一步了解。
|
||||
|
||||
<ruby>卷<rt>Volume</rt></ruby>：卷是一个逻辑存储区域，可用于存储数据。在磁盘加密的场景中卷指的是已加密以保护其内容的磁盘部分。
|
||||
|
||||
<ruby>参数<rt>Parameters</rt></ruby>：参数是控制加密算法运行方式的设置。参数可能包括所使用的加密算法、密钥大小以及有关如何执行加密的其他详细信息。
|
||||
|
||||
<ruby>加密类型<rt>Cipher type</rt></ruby>**：它是指用于加密的数学算法。它指的是用于保护加密卷上数据的具体加密算法。
|
||||
|
||||
<rt>密钥大小<rt>Key size</rt></ruby>：密钥大小是衡量加密算法强度的指标：密钥大小越大，加密强度越高。通常以位数表示，例如 128 位加密或 256 位加密。
|
||||
|
||||
<ruby>头部<rt>Header</rt></ruby>：头部是加密卷开头的特殊区域，包含有关加密的信息，例如所使用的加密算法和加密密钥。
|
||||
|
||||
下一个定义对于新手来说可能有些棘手，但了解它还是很重要的，尤其在处理 LUKS 时，这会非常有用。
|
||||
|
||||
<ruby>容器<rt>Container</rt></ruby>：容器是一个特殊的文件，类似于虚拟加密卷。它可以用于存储加密数据，就像加密分区一样。不同之处在于容器是一个文件，可以存储在未加密的分区上，而加密分区是整个磁盘的一部分，已经完全加密。因此，容器是 _充当虚拟加密卷的文件_。
|
||||
|
||||
### LUKS 是什么以及它能做什么？
|
||||
|
||||
LUKS（<ruby>[Linux 统一密钥设置][1]<rt>Linux Unified Key Setup</rt></ruby>）是由 Clemens Fruhwirth 在 2004 年创建的磁盘加密规范，最初用于 Linux。它是一种知名的、安全的、高性能的磁盘加密方法，基于改进版本的 [cryptsetup][2]，使用 [dm-crypt][3] 作为磁盘加密后端。LUKS 也是网络附加存储（NAS）设备中常用的加密格式。
|
||||
|
||||
LUKS 还可以用于创建和运行加密容器。加密容器具有与 LUKS 全盘加密相同的保护级别。LUKS 还提供多种加密算法、多种加密模式和多种哈希函数，有 40 多种可能的组合。
|
||||
|
||||
![LUKS 结构示意图][4]
|
||||
|
||||
任何文件系统都可以进行加密，包括交换分区。加密卷的开头有一个未加密的头部，它允许存储多达 8 个（LUKS1）或 32 个（LUKS2）加密密钥，以及诸如密码类型和密钥大小之类的加密参数。
|
||||
|
||||
这个头部的存在是 LUKS 和 dm-crypt 的一个重要区别，因为头部允许使用多个不同的密钥短语，并能轻松更改和删除它们。然而，值得提醒的是，如果头部丢失或损坏，设备将无法解密。
|
||||
|
||||
LUKS 有两个版本，LUKS2 具有更强的头部损坏抗击性，并默认使用 [Argon2][5] 加密算法（LUKS1 使用 [PBKDF2][6]）。在某些情况下，可以在两个版本之间进行转换，但是 LUKS1 可能不支持某些功能。
|
||||
|
||||
### 希望了解更多信息？
|
||||
|
||||
希望本文有助于你对 LUKS 和加密有一些了解。关于使用 LUKS 创建和使用加密分区的确切步骤会因个人需求而异，因此我不会在此处涵盖安装和设置方面的内容。
|
||||
|
||||
如果你想要一份指南来帮助你设置 LUKS，可以在这篇文章中找到一个很好的指南：《[使用 LUKS 对 Linux 分区进行基本加密指南][7]》。如果你对此还不熟悉，并且想要尝试使用 LUKS，可以在虚拟机或闲置计算机上进行安全学习，以了解其工作原理。
|
||||
|
||||
*（题图：MJ/2c6b83e6-4bcb-4ce3-a49f-3cb38caad7d2）*
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
via: https://itsfoss.com/luks/
|
||||
|
||||
作者：[Bill Dyer][a]
|
||||
选题：[lkxed][b]
|
||||
译者：ChatGPT
|
||||
校对：[wxy](https://github.com/wxy)
|
||||
|
||||
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出
|
||||
|
||||
[a]: https://itsfoss.com/author/bill/
|
||||
[b]: https://github.com/lkxed/
|
||||
[1]: https://en.wikipedia.org/wiki/Linux_Unified_Key_Setup?ref=its-foss
|
||||
[2]: https://www.tutorialspoint.com/unix_commands/cryptsetup.htm?ref=its-foss
|
||||
[3]: https://www.kernel.org/doc/html/latest/admin-guide/device-mapper/dm-crypt.html?ref=its-foss
|
||||
[4]: https://itsfoss.com/content/images/2023/03/luks-schematic-diagram.png
|
||||
[5]: https://www.argon2.com/?ref=its-foss
|
||||
[6]: https://en.wikipedia.org/wiki/PBKDF2?ref=its-foss
|
||||
[7]: https://linuxconfig.org/basic-guide-to-encrypting-linux-partitions-with-luks?ref=its-foss
|
||||
[0]: https://img.linux.net.cn/data/attachment/album/202308/05/230710ioll6lxm11mrtl8l.jpg
|
||||
@ -1,86 +0,0 @@
|
||||
[#]: subject: "Linux Jargon Buster: What is LUKS Encryption?"
|
||||
[#]: via: "https://itsfoss.com/luks/"
|
||||
[#]: author: "Bill Dyer https://itsfoss.com/author/bill/"
|
||||
[#]: collector: "lkxed"
|
||||
[#]: translator: " "
|
||||
[#]: reviewer: " "
|
||||
[#]: publisher: " "
|
||||
[#]: url: " "
|
||||
|
||||
Linux Jargon Buster: What is LUKS Encryption?
|
||||
======
|
||||
|
||||
Computer security methods are designed to keep private things, well, private. There are many ways to secure a system. Some users use a simple username/password login scheme for basic protection. Other users may use extra protection through encryption in various ways like using VPN and disk encryption.
|
||||
|
||||
If you have sensitive client data on your machine (you might be running a business) or material deemed intellectual property or you are privacy cautious, you may want to consider disk encryption.
|
||||
|
||||
Some benefits of disk encryption are:
|
||||
|
||||
- Secure your system from hackers
|
||||
- Prevent data leaks
|
||||
- Protect you from potential liability issues
|
||||
|
||||
Disk encryption software prevents a desktop hard disk drive, a portable USB storage device, or laptop, from accessing unless the user inputs the correct authentication data. If your laptop is ever lost or stolen, encryption protects the data on the disk.
|
||||
|
||||
These days, new Windows-powered systems come with BitLocker encryption by default. On Linux, LUKS is the most popular way of employing disk encryption.
|
||||
|
||||
Wondering what is LUKS? I'll brief you on the topic.
|
||||
|
||||
### Technical jargons
|
||||
|
||||
Before going further, some terms should be defined. There is a lot to LUKS so it will help to break things down, especially if you're beginning to look into this.
|
||||
|
||||
**Volume**: A volume is a logical storage area that can be used to store data. In the context of disk encryption, a volume refers to a portion of a disk that has been encrypted to protect its contents.
|
||||
|
||||
**Parameters**: Parameters are settings that control how an encryption algorithm works. Parameters might include the encryption algorithm used, the key size, and other details about how the encryption should be performed.
|
||||
|
||||
**Cipher type**: A cipher is a mathematical algorithm used for encryption It refers to the specific encryption algorithm that is being used to protect the data on an encrypted volume.
|
||||
|
||||
**Key size**: The key size is a measure of the strength of an encryption algorithm: the larger the key size, the stronger the encryption. It is often expressed in bits, such as 128-bit encryption or 256-bit encryption.
|
||||
|
||||
**Header**: The header is a special area at the beginning of an encrypted volume that contains information about the encryption, such as the encryption algorithm used and the encryption keys.
|
||||
|
||||
The next definition can be tricky to a newcomer, but it's worth knowing about, especially when dealing with LUKS; it's quite handy.
|
||||
|
||||
**Container**: A container is a special file that acts like a virtual encrypted volume. It can be used to store encrypted data, just like an encrypted partition. The difference is that a container is a file that can be stored on an unencrypted partition, while an encrypted partition is a portion of a disk that has been encrypted as a whole. A container, then, is a file _that acts as a virtual encrypted volume_.
|
||||
|
||||
### What Is LUKS and What Can It Do?
|
||||
|
||||
[Linux Unified Key Setup - LUKS][1] is a disk encryption specification created by Clemens Fruhwirth in 2004 and was originally intended for Linux. It is a well-known, secure, and high-performance disk encryption method based on an enhanced version of [cryptsetup][2], using [dm-crypt][3] as the disk encryption backend. LUKS is also a popular encryption format in Network Attached Storage (NAS) devices.
|
||||
|
||||
LUKS can also be used to create and run encrypted containers. Encrypted containers feature the same level of protection as LUKS full-disk encryption. LUKS also offers multiple encryption algorithms, several modes of encryption, and several hash functions - a little over 40 possible combinations.
|
||||
|
||||
![LUKS schematic diagram][4]
|
||||
|
||||
Any filesystem can be encrypted, including the swap partition. There is an unencrypted header at the beginning of an encrypted volume, which allows up to 8 (LUKS1) or 32 (LUKS2) encryption keys to be stored along with encryption parameters such as cipher type and key size.
|
||||
|
||||
The existence of this header is a major difference between LUKS and dm-crypt, since the header allows multiple different passphrases to be used, with the ability to change and remove them easily. It is worth a reminder, however, that if the header is lost or corrupted, the device will no longer be decryptable.
|
||||
|
||||
There are two versions of LUKS, with LUKS2 having features such as greater resistance to header corruption, and the use of [Argon2][5] encryption algorithm by default (LUKS1 uses [PBKDF2][6]). Conversion between both versions of LUKS is possible in certain situations, but some features may not be available with LUKS1.
|
||||
|
||||
### Where Can I Learn More?
|
||||
|
||||
I am hopeful that this short article is a help in understanding a little about LUKS and encryption. The exact steps for creating and using an encrypted partition with LUKS varies, depending on an individual's specific needs, so I will not cover installation and setup here.
|
||||
|
||||
If you want a guide to lead you though setting up LUKS, an excellent guide can be found in this article: [Basic Guide To Encrypting Linux Partitions With LUKS][7]. If you're new at this, and you want to try out LUKS, safe learning can be done on a virtual machine or a spare computer to get a feel for how it works.
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
via: https://itsfoss.com/luks/
|
||||
|
||||
作者：[Bill Dyer][a]
|
||||
选题：[lkxed][b]
|
||||
译者：[译者ID](https://github.com/译者ID)
|
||||
校对：[校对者ID](https://github.com/校对者ID)
|
||||
|
||||
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出
|
||||
|
||||
[a]: https://itsfoss.com/author/bill/
|
||||
[b]: https://github.com/lkxed/
|
||||
[1]: https://en.wikipedia.org/wiki/Linux_Unified_Key_Setup?ref=its-foss
|
||||
[2]: https://www.tutorialspoint.com/unix_commands/cryptsetup.htm?ref=its-foss
|
||||
[3]: https://www.kernel.org/doc/html/latest/admin-guide/device-mapper/dm-crypt.html?ref=its-foss
|
||||
[4]: https://itsfoss.com/content/images/2023/03/luks-schematic-diagram.png
|
||||
[5]: https://www.argon2.com/?ref=its-foss
|
||||
[6]: https://en.wikipedia.org/wiki/PBKDF2?ref=its-foss
|
||||
[7]: https://linuxconfig.org/basic-guide-to-encrypting-linux-partitions-with-luks?ref=its-foss
|
||||
Loading…
Reference in New Issue
Block a user