disabled "lm_J*j"TvZTţ h1 "lm_J*j"TvYbѿ h0 "lm_J*j"TvCp@S h1 " lY>*C]m@=p,Tţ u. Cryptsetup 2.3.0 Release Notes ============================== Stable release with new experimental features and bug fixes. Cryptsetup 2.3 version introduces support for BitLocker-compatible devices (BITLK format). This format is used in Windows systems, and in combination with a filesystem driver, cryptsetup now provides native read-write access to BitLocker Full Disk Encryption devices. The BITLK implementation is based on publicly available information and it is an independent and opensource implementation that allows one to access this proprietary disk encryption. Changes since version 2.2.2 ~~~~~~~~~~~~~~~~~~~~~~~~~~~ * BITLK (Windows BitLocker compatible) device access BITLK userspace implementation is based on the master thesis and code provided by Vojtech Trefny. Also, thanks to other opensource projects like libbde (that provide alternative approach to decode this format) we were able to verify cryptsetup implementation. NOTE: Support for the BITLK device is EXPERIMENTAL and will require a lot of testing. If you get some error message (mainly unsupported metadata in the on-disk header), please help us by submitting an issue to cryptsetup project, so we can fix it. Thank you! Cryptsetup supports BITLK activation through passphrase or recovery passphrase for existing devices (BitLocker and Bitlocker to Go). Activation through TPM, SmartCard, or any other key protector is not supported. And in some situations, mainly for TPM bind to some PCR registers, it could be even impossible on Linux in the future. All metadata (key protectors) are handled read-only, cryptsetup cannot create or modify them. Except for old devices (created in old Vista systems), all format variants should be recognized. Data devices can be activated read-write (followed by mounting through the proper filesystem driver). To access filesystem on the decrypted device you need properly installed driver (vfat, NTFS or exFAT). Foe AES-XTS, activation is supported on all recent Linux kernels. For older AES-CBC encryption, Linux Kernel version 5.3 is required (support for special IV variant); for AES-CBC with Elephant diffuser, Linux Kernel 5.6 is required. Please note that CBC variants are legacy, and we provide it only for backward compatibility (to be able to access old drives). Cryptsetup command now supports the new "bitlk" format and implement dump, open, status, and close actions. To activate a BITLK device, use # cryptsetup open --type bitlk or with alias # cryptsetup bitlkOpen Then with properly installed fs driver (usually NTFS, vfat or exFAT), you can mount the plaintext device /dev/mapper device as a common filesystem. To print metadata information about BITLK device, use # crypotsetup bitlkDump To print information about the active device, use # cryptsetup status Example (activation of disk image): ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Recent blkid recognizes BitLocker device,just to verity # blkid bitlocker_xts_ntfs.img bitlocker_xts_ntfs.img: TYPE="BitLocker" # Print visible metadata information (on-disk, form the image) # cryptsetup bitlkDump bitlocker_xts_ntfs.img Info for BITLK device bitlocker_xts_ntfs.img. Version: 2 GUID: ... Created: Wed Oct 23 17:38:15 2019 Description: DESKTOP-xxxxxxx E: 23.10.2019 Cipher name: aes Cipher mode: xts-plain64 Cipher key: 128 bits Keyslots: 0: VMK GUID: ... Protection: VMK protected with passphrase Salt: ... Key data size: 44 [bytes] 1: VMK GUID: ... Protection: VMK protected with recovery passphrase Salt