About cryptsetup-LUKS

• cryptsetup now has LUKS built in, in recent Debians and Ubuntu. Hopefully your own distro is recent enough to have it too

• 2.6.10 or better required for proper cryptsetup-LUKS support

• LUKS offers 8 keyslots for passphrases that can unlock the main crypto setup (essential for storing a user key and at least one backup recovery key)

• keyslots are essential for changing passwords (plain cryptsetup requires re-encrypting the whole data)

• LUKS protects against dictionary attacks with PBKDF2 (many computing intensive iterations)