CRYPTSETUP-OPEN(8) (NAME) cryptsetup-open - /dev/mapper (SYNOPSIS) cryptsetup open --type <_> [<>] <> <> (DESCRIPTION) <> <> /dev/mapper . plain luks () luks1 luks2 loopaes tcrypt . open : create ( <> <>): open --type plain plainOpen: open --type plain luksOpen: open --type luks loopaesOpen: open --type loopaes tcryptOpen: open --type tcrypt bitlkOpen: open --type bitlk <> . create <> <> <> <> . (PLAIN) open --type plain <> <> --cipher <> --key-size <> --hash <> plainOpen <> <> ( ) create <> <> ( ) <> <> . --cipher --key-size ( ) --hash cryptsetup . plain (kernel keyring) --volume-key-keyring . cryptsetup cryptsetup plain . ( resize) . . <> : [--hash, --cipher, --sector-size, --key-file, --keyfile-size, --keyfile-offset, --key-size, --offset, --skip, --device-size, --size, --readonly, --shared, --allow-discards, --refresh, --timeout, --verify-passphrase, --iv-large-sectors, --volume-key-keyring]. : /dev/sda10 /dev/mapper/e1 : cryptsetup open --type plain --cipher aes-cbc-essiv:sha256 --key-size 256 --hash sha256 /dev/sda10 e1 . (trusted) %trusted:mykey: cryptsetup open --type plain /dev/sda10 e1 --volume-key-keyring=%trusted:mykey --cipher aes-xts-plain64 --key-size 256 . LUKS open <> <> open --type <> <> ( ) luksOpen <> <> ( ) LUKS <> <> . LUKS2 (PIN) . ( ) --key-file . LUKS2 (PIN) : --token-only --token-type --token-id . <> : [--key-file, --keyfile-offset, --keyfile-size, --readonly, --test-passphrase, --allow-discards, --header, --key-slot, --volume-key-file, --token-id, --token-only, --token-type, --disable-external-tokens, --disable-keyring, --disable-locks, --type, --refresh, --serialize-memory-hard-pbkdf, --unbound, --tries, --timeout, --verify-passphrase, --persistent, --volume-key-keyring, --link-vk-to-keyring, --external-tokens-path]. loopAES open --type loopaes <> <> --key-file <_> loopaesOpen <> <> --key-file <_> ( ) loop-AES <> <> . GnuPG --key-file=- : gpg --decrypt | cryptsetup loopaesOpen --key-file=- <> <> loop-AES (newline) . (pipe) : echo $keyfile | cryptsetup loopaesOpen --key-file=- <> <> --keyfile-size . --offset . . --skip (IV) . IV offset --skip 0 . --hash ( ). <> : [--cipher, --key-file, --keyfile-size, --keyfile-offset, --key-size, --offset, --skip, --hash, --readonly, --allow-discards, --refresh]. TrueCrypt VeraCrypt open --type tcrypt <> <> tcryptOpen <> <> ( ) TCRYPT ( TrueCrypt VeraCrypt) <> <> . --key-file . --key-file . LUKS . --cipher --hash PBKDF2 . ( ). --header (hidden) (system) . --allow-discards --tcrypt-hidden . ( ). <> : [--key-file, --tcrypt-hidden, --tcrypt-system, --tcrypt-backup, --readonly, --test-passphrase, --allow-discards, --veracrypt ( ), --disable-veracrypt, --veracrypt-pim, --veracrypt-query-pim, --header, --cipher, --hash, --tries, --timeout, --verify-passphrase]. BitLocker open --type bitlk <> <> bitlkOpen <> <> ( ) BITLK ( BitLocker ) <> <> . --test-passphrase --volume-key-file . --volume-key-file . <> : [--key-file, --keyfile-offset, --keyfile-size, --key-size, --readonly, --test-passphrase, --allow-discards, --volume-key-file, --tries, --timeout, --verify-passphrase]. FileVault2 open --type fvault2 <> <> fvault2Open <> <> ( ) FVAULT2 ( FileVault2 ) <> <> . <> : [--key-file, --keyfile-offset, --keyfile-size, --key-size, --readonly, --test-passphrase, --allow-discards, --volume-key-file, --tries, --timeout, --verify-passphrase]. (OPTIONS) --allow-discards (TRIM/discard) . LUKS2 . : . . . . . . --batch-mode, -q . ! --verify-passphrase . --cipher, -c <_> (cipher) plain . tcrypt . cryptsetup --help . () (IV) . ESSIV "plain64" . XTS -s . XTS . --debug --debug-json . # . --debug-json LUKS2 JSON . --device-size [] . plain . . S K/M/G/T ( KiB MiB GiB TiB) KB/MB/GB/TB ( SI) . --disable-external-tokens () LUKS2 . --disable-keyring (kernel keyring) dm-crypt . LUKS2 . --disable-locks . LUKS2 . : cryptsetup ( /run ). --disable-veracrypt VeraCrypt ( TrueCrypt ). TCRYPT cryptsetup(8) . --external-tokens-path <_> cryptsetup ( ) . ( '/' ). --hash, -h <_> . plain loopaes . tcrypt PBKDF2 . --header < LUKS> () . : (ciphertext) . --header . . --help, -? . --iv-large-sectors (IV) ( ) . plain . . --key-description (keyring) . --key-file, -d . "-" (stdin) . . plain --key-file dm-crypt . (stdin) (digest) dm-crypt . NOTES ON PASSPHRASE PROCESSING cryptsetup(8) . --keyfile-offset . --keyfile-size, -l . --help . . (trailing newlines) . --keyfile-offset . --key-size, -s . . . /proc/crypto . /proc/crypto . plain luks . LUKS2 (reencryption) . --key-size --volume-key-file ( ). --key-slot, -S <0-N> (keyslot) . . LUKS . LUKS1 . LUKS2 LUKS2 . --link-vk-to-keyring <_>::<_> ( ). ( --test-passphrase ). <_> . "%:" "%keyring:" . . "@" . "::" . <_> <_> . "%<_>:" . user . ( ) . KEY IDENTIFIERS keyctl(1) . --offset, -o < > . plain loopaes . --perf-high_priority dm-crypt (writer thread) . (throughput) (latency) dm-crypt . dm-crypt dm-crypt . . . --perf-no_read_workqueue, --perf-no_write_workqueue dm-crypt . dm-crypt dm-crypt . . . --perf-same_cpu_crypt (CPU) / (IO) . (unbound workqueue) . dm-crypt dm-crypt . --perf-submit_from_crypt_cpus . bio . bio . dm-crypt dm-crypt . --persistent LUKS2 open refresh . ( crypttab .) --persistent ( discard --persistent --allow-discards ). --allow-discards --perf-same_cpu_crypt --perf-submit_from_crypt_cpus --perf-no_read_workqueue --perf-no_write_workqueue --integrity-no-journal . --readonly, -r . --refresh (refresh) . cryptsetup-refresh(8) . --sector-size plain . . . . . . --serialize-memory-hard-pbkdf PBKDF (memory-hard) . (OOM killer) . ! --shared . . plain . --offset --size --skip . --size, -b < > . plain . --skip, -p < > IV ( ). plain loopaes . --offset n --skip s n ( ) IV s . --tcrypt-backup, --tcrypt-hidden, --tcrypt-system TrueCrypt . TCRYPT cryptsetup(8) . --tcrypt-system . TrueCrypt/VeraCrypt ( ) ( ) . . cryptsetup . cryptsetup . ( /dev/sdb) ( /dev/sdb1) . ( ) --header . --header ( ) cryptsetup . --header ( ) cryptsetup ( ) . . loop (losetup -P losetup(8) ) ( /dev/loopXp1) . --test-passphrase . . --timeout, -t (timeout) . . --key-file . ( ) . . --token-id . ( ) . --token-only . . LUKS2 . --token-type . --token-id . LUKS2 . --tries, -T . . --type BASIC ACTIONS cryptsetup(8) . --unbound --test-passphrase (unbound) LUKS2 . --key-slot . --usage . --veracrypt VeraCrypt . --veracrypt-pim, --veracrypt-query-pim (PIM - Personal Iteration Multiplier) VeraCrypt . TCRYPT cryptsetup(8) . --verify-passphrase, -y . plain . (stdin) . --version, -V . --volume-key-file , --master-key-file ( ) . luks bitlk . . --volume-key-file --key-size . --volume-key-keyring <_> (keyring) . luks plain . LUKS . . PLAIN . . <_> keyctl . %<_>:<_> . KEY IDENTIFIERS keyctl(1) . %<_>: user ( ) . (EXAMPLES) LUKS my_backup : cryptsetup open /dev/sdb1 my_backup /dev/mapper/my_backup : mount /dev/mapper/my_backup /mnt/backup LUKS : cryptsetup open --key-file /root/secret.key /dev/sdb1 my_backup LUKS (TRIM) SSD: cryptsetup open --allow-discards /dev/nvme0n1p3 cryptroot ( plain) : cryptsetup open --type plain --cipher aes-xts-plain64 --key-size 512 /dev/sdb1 my_plain LUKS : cryptsetup open --header /media/usb/header.img /dev/sdc1 private_data : cryptsetup open --test-passphrase /dev/sdb1 VeraCrypt TrueCrypt: cryptsetup open --type tcrypt /dev/sdd1 tcrypt_volume (REPORTING BUGS) cryptsetup . --debug . (SEE ALSO) cryptsetup (FAQ) cryptsetup(8), integritysetup(8) veritysetup(8) (CRYPTSETUP) cryptsetup . cryptsetup 2.8.7 2026-07-21 CRYPTSETUP-OPEN(8)