Migration from cryptoloop and compatibility

The on-disk layouts used by the current 2.6 cryptoloop are supported by dm-crypt.
Cryptoloop also uses cryptoapi so the name of the ciphers are the same. Cryptoloop also supports ECB and CBC mode. Use <cipher>-ecb and <cipher>-plain accordingly with dm-crypt. If you didn't explicitly specify either -ecb or -cbc before you don't need it now, the default plain IV generation will be used. There will be additional (incompatible, but more secure) possibilities in the future because the unhashed sector number as IV is too predictable.

You'll need to figure out how your passphrase was turned into a key to use for losetup. There are several patches floating around doing things differently. But usually cryptsetup will provide a working solution to recreate the same key from your passphrase.

If you want to migrate from 2.4 cryptoloop please take a look at
Clemens Fruhwirth's Cryptoloop Migration Guide. He describes the differences between 2.4 and 2.6 cryptoapi (or basically the bugs in 2.4 cryptoapi...). If you need to cut the key size you can use the -s option instead of playing with dd. (BTW: Clemens has a i586 optimised version of the aes and serpent cipher on his page, about twice as fast as the kernel implementation.)

Clemens Fruhwirth has written lo-tracker which he writes the following about:

If anyone tries this tool, please update this page with your experiences.


The machine I used for this test was running Gentoo Linux with a 2.6.9 kernel. This is how I used to mount the encrypted filesystem:


And this is how the I now mount the filesystem with dm-crypt and cryptsetup:


Cryptsetup version 0.1 does not support mounting files directly so we need to use the kernels loopback support with losetup. The next release of cryptsetup will support a setup like this: