I would like to set up disk encryption on Ubuntu 13.10 such that I have

  • plain /
  • encrypted /home partition
  • encrypted swap partition
  • working hibernation and resume

As these requirements suggest, this is to protect me from a potential laptop thief reading my personal data. With / being unencrypted, it does not protect from somebody taking the laptop, installing a keylogger, and giving it back to me.

I have read EnableHibernateWithEncryptedSwap but it's written for Ubuntu 12.04, and I'm not confident that it still works or that it's the recommended way.

What would be up-to-date setup?


I managed to set up an encrypted home and encrypted swap with working hibernate.

I use uswsusp and largely followed this article - still works for Ubuntu 13.10.

  • On boot, I get two password prompts (one for home and one for swap) under the Ubuntu logo.
  • With apt-get install uswsusp, Ubuntu automatically switched pm-hibernate to use uswsusp, so all GUI tools use it as well.
  • On resume from hibernate, I get one password prompt as expected.

Some parts of my setup:

Creating the encrypted partitions

# For /home
sudo cryptsetup --cipher aes-xts-plain --key-size 256 --hash sha512 --use-random --verify-passphrase luksFormat /dev/sdb2
# For swap
sudo cryptsetup --cipher aes-xts-plain --key-size 256 --hash sha512 --use-random --verify-passphrase luksFormat /dev/sdb3
  • I use aes-xts-plain because it is the fastest in cryptsetup benchmark (only works with cryptsetup >= 1.6). Many guides uses aes-cbc-essiv, but from what I've read so far, xts protects against watermarking just as well as cbc-essiv. If you use partitions >= 2TB, you should use aes-xts-plain64 instead of -plain. More info about these options and choices can be found here.

  • After creating these partitions, you of course have to create the according filesystems on them, e.g. with mkswap /dev/mapper/cryptoposwap and mkfs.ext4 /dev/mapper/cryptohome.


cryptohome   /dev/disk/by-uuid/8cef7fd1-cceb-4a4a-9902-cb9a5805643c   none   luks,discard
cryptoswap   /dev/disk/by-uuid/a99c196d-55df-460f-a162-00c4ea6d46e6   none   luks,discard


UUID=a4a2187d-a2d2-4a4c-9746-be511c151296  /       ext4   errors=remount-ro  0  1
/dev/mapper/cryptoswap                     none    swap   sw,discard         0  0
/dev/mapper/cryptohome                     /home   ext4   discard            0  2
  • I use the discard option in boths crypttab and fstab to enable TRIM for the SSD I'm using.
  • I had to adjust /etc/initramfs-tools/conf.d/resume away from the old swap UUID to the new /dev/mapper/cryptoswap to get rid of a warning at update-initramfs -u -k all.

This is still very similar to EnableHibernateWithEncryptedSwap, but it looks like I didn't have to edit /usr/share/initramfs-tools/scripts/local-top/cryptroot, /etc/acpi/hibernate.sh (if you have a hint why it was needed, please leave a comment - maybe the difference is that this setup uses uswsusp?).

  • +1 as your answer led me on the right track but i either mixed something up or it was because there is no mkswap performed after luksFormat which made me lack a UUID for cryptoswap (=the luksOpened swap-partiton). after further research i finally succeeded in getting hibernate working with the help of this answer given to a related question.
    – antiplex
    Jan 9 '15 at 12:25
  • @antiplex Yes, the filesystems must have been created with mkswap on /dev/mapper/cryptoposwap and with mkfs.ext4 (or other file system) on /dev/mapper/cryptohome` - I did not list these steps explicitly. Will update the answer accordingly.
    – nh2
    Jan 9 '15 at 14:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.