# man > crypttab(5) --- type: CommandReference command: crypttab mode: man section: 5 source: man-pages --- ## Quick Reference - `cswap /dev/sda6 /dev/urandom plain,cipher=aes-xts-plain64,size=256,hash=sha1,swap` — Encrypted swap device - `cdisk0 UUID=12345678-9abc-def012345-6789abcdef01 none luks,discard` — LUKS with UUID, discard enabled - `tdisk0 /dev/sr0 none tcrypt,discard` — TrueCrypt volume with discard - `cdisk1 /dev/sda2 none plain,cipher=aes-xts-plain64,size=256,hash=sha1,check,checkargs=ext4,tries=5,discard` — Plain with filesystem check and retries - `cdisk2 /dev/sdc1 none plain,cipher=aes-xts-plain64,size=256,hash=sha1,check=customscript,tries=1,discard` — Custom check script, no retries - `cdisk3 /dev/sda3 none plain,cipher=twofish,size=256,hash=ripemd160,discard` — Twofish cipher, RIPEMD-160 hash ## Name `crypttab` — static information about encrypted filesystems ## Synopsis `/etc/crypttab` contains entries with four whitespace-separated fields: - **target** — mapped device name (created under `/dev/mapper/`). - **source device** — block special device, file, or UUID/LABEL/PARTUUID/PARTLABEL. - **key file** — path to passphrase file, device (e.g. `/dev/urandom`), or `none` for interactive input. - **options** — comma-separated list of options (see below). Lines starting with `#` are comments. Order matters: dependencies must be listed first. ## Options ### Encryption Options - `cipher=` — Encryption algorithm (ignored for LUKS and TCRYPT). See `cryptsetup -c`. - `size=` — Encryption key size (ignored for LUKS and TCRYPT). See `cryptsetup -s`. - `sector-size=` — Sector size. See `cryptsetup(8)` for defaults. - `hash=` — Hash algorithm (ignored for LUKS and TCRYPT). See `cryptsetup -h`. - `offset=` — Start offset (ignored for LUKS and TCRYPT). See `cryptsetup -o`. - `skip=` — Skip sectors at beginning (ignored for LUKS and TCRYPT). See `cryptsetup -p`. ### Key Management Options - `keyfile-offset=` — Number of bytes to skip at start of key file. - `keyfile-size=` — Maximum bytes to read from key file (default: entire file up to compile-time max). Ignored for plain dm-crypt. - `keyslot=` or `key-slot=` — Key slot number (ignored for non-LUKS). See `cryptsetup -S`. - `header=` — Detached header file (ignored for plain dm-crypt). See `cryptsetup --header`. - `verify` — Verify password (uses `cryptsetup -y`). ### Device Behavior Options - `readonly` or `read-only` — Set up read-only mapping. - `tries=` — Number of unlock attempts before failing (default 3; `0` = infinite). Useful with interactive passphrase or keyscript. - `discard` — Allow TRIM/discard requests. **Warning**: may leak information about ciphertext device (filesystem type, used space). Leak assessment is your responsibility. - `same-cpu-crypt` — Perform encryption on same CPU that submitted IO. - `submit-from-crypt-cpus` — Disable offloading writes to a separate thread after encryption. - `no-read-workqueue` — Bypass dm-crypt internal workqueue for read requests. - `no-write-workqueue` — Bypass dm-crypt internal workqueue for write requests. ### Mode Options - `luks` — Force LUKS mode. Ignores `cipher=`, `hash=`, `size=` (read from header). - `plain` — Force plain encryption mode (default). - `bitlk` — Force BITLK (Windows BitLocker) mode. **Experimental**. - `tcrypt` — Use TrueCrypt mode. Ignores `cipher=`, `hash=`, `keyfile-offset=`, `keyfile-size=`, `size=`. - `veracrypt` or `tcrypt-veracrypt` — VeraCrypt extension to TrueCrypt (requires `tcrypt`). - `tcrypthidden` or `tcrypt-hidden` — Use hidden TCRYPT header (ignored for non-TCRYPT). ### Debian-Specific Options - `swap` — Run `mkswap` on the created device. Ignored for initramfs devices. - `tmp[=]` — Run `mkfs` with filesystem type `` (default `ext4`). Ignored for initramfs. - `check[=]` — Check target device content with a program. Program is full path or relative to `/lib/cryptsetup/checks/`. Default: `$CRYPTDISKS_CHECK` (usually `blkid`). Not supported by systemd. - `checkargs=` — Pass arguments to the check script (second argument). Not supported by systemd. - `initramfs` — Process device in initramfs stage (e.g., for remote unlocking). Not supported by systemd. - `noearly` — Skip device during first cryptsetup invocation (before LVM/RAID). Ignored for initramfs. Not supported by systemd. - `noauto` — Ignore device at boot; can still be mapped manually with `cryptdisks_start`. Ignored for initramfs. Not supported by systemd. - `loud` — Print warnings if device does not exist. Overrides `quiet`. Ignored for initramfs. Not supported by systemd. - `quiet` — Suppress warnings if device does not exist. Overrides `loud`. Ignored for initramfs. Not supported by systemd. - `keyscript=` — Execute the given script (full path or relative to `/lib/cryptsetup/scripts/`) with the third field as argument. The script's stdout is used as the decryption key. **Warning**: with systemd as init, this option may be ignored; use `initramfs` to force processing. Environment variables are exported to the keyscript (see below). Not supported by systemd. ### Check Scripts (used with `check` option) - `blkid` — Checks for any known filesystem. With `checkargs`: - no argument: succeeds if any valid filesystem found. - `"none"`: succeeds if no valid filesystem. - `"ext4"` (or other): succeeds if that filesystem type is found. - `un_blkid` — Checks for no known filesystem. With `checkargs`: - no argument: succeeds if no valid filesystem. - `"ext4"` (or other): succeeds if that filesystem type is not found. ### Keyscript Environment Variables When a keyscript is executed, the following environment variables are set: - `CRYPTTAB_NAME` — Target name (after octal decoding). - `CRYPTTAB_SOURCE` — Source device (after decoding and resolution). - `CRYPTTAB_KEY` — Value of the third field (after decoding). - `CRYPTTAB_OPTIONS` — List of exported options (after decoding). - `CRYPTTAB_OPTION_