# Encrypting Your Root File System on RASPBERRY PI - using LUKS & dm-crypt **URL:** \ **Category:** Encrypting File System\ **Created:** [May 15, 2017, 6:22am UTC](https://community.zymbit.com/t/encrypting-your-root-file-system-on-raspberry-pi-using-luks-dm-crypt/150 "2017-05-15T06:22:09Z")\ **Posts on this page:** 20\ **Page:** 8
**Author:** ![mmuehle](https://avatars.discourse-cdn.com/v4/letter/m/ecb155/32.png) [@mmuehle](https://community.zymbit.com/u/mmuehle)\ **Post date:** [August 29, 2019, 6:03am UTC](https://community.zymbit.com/t/encrypting-your-root-file-system-on-raspberry-pi-using-luks-dm-crypt/150/142 "2019-08-29T06:03:22Z")
Hi all, What is ment by “Zymkey operational status is “secure” or “dev\_secure””. I’ve used the zymkey insall script and the zymkey encrypt skript. Do I need to do another step to activate these “secure modes”? Is there a correlation with the dev and production mode? Best regards ---
**Author:** ![Bob\_of\_Zymbit](https://avatars.discourse-cdn.com/v4/letter/b/82dd89/32.png) [@Bob\_of\_Zymbit](https://community.zymbit.com/u/Bob_of_Zymbit)\ **Post date:** [August 29, 2019, 6:27am UTC](https://community.zymbit.com/t/encrypting-your-root-file-system-on-raspberry-pi-using-luks-dm-crypt/150/143 "2019-08-29T06:27:16Z")
The Zymkey is in development mode until the lock tab is cut. Once the lock tab has been removed, the Zymkey will be in production mode. When the Zymkey is in production mode, the Zymkey will not work in another Pi or have its SD card changed. Also, if one or more tamper detect inputs have been put into “self destruct” modes and a tamper detect event has been observed, the Zymkey will destroy its key material and will no longer continue to operate. ---
**Author:** ![mmuehle](https://avatars.discourse-cdn.com/v4/letter/m/ecb155/32.png) [@mmuehle](https://community.zymbit.com/u/mmuehle)\ **Post date:** [August 29, 2019, 7:06am UTC](https://community.zymbit.com/t/encrypting-your-root-file-system-on-raspberry-pi-using-luks-dm-crypt/150/144 "2019-08-29T07:06:35Z")
Hi Scott, thanks for your quick answer. I’ve understood the dev and production mode, but whats with the explanation above how the encryption key is released. **Zymkey operational status is “secure” or “dev\_secure** ” Do I have to do something to get into one of these states? ---
**Author:** ![Bob\_of\_Zymbit](https://avatars.discourse-cdn.com/v4/letter/b/82dd89/32.png) [@Bob\_of\_Zymbit](https://community.zymbit.com/u/Bob_of_Zymbit)\ **Post date:** [August 29, 2019, 7:25am UTC](https://community.zymbit.com/t/encrypting-your-root-file-system-on-raspberry-pi-using-luks-dm-crypt/150/145 "2019-08-29T07:25:27Z")
It looks like we have a bit of mis-documentation here. There is no “dev\_secure” state. The state “secure” means that if the tamper detect inputs have been configured for “self-destruct” while in production mode, the tamper loop must be closed to be considered “secure” otherwise, the Zymkey will no longer work. ---
**Author:** ![josenovera](https://avatars.discourse-cdn.com/v4/letter/j/50afbb/32.png) [@josenovera](https://community.zymbit.com/u/josenovera)\ **Post date:** [November 8, 2019, 12:42am UTC](https://community.zymbit.com/t/encrypting-your-root-file-system-on-raspberry-pi-using-luks-dm-crypt/150/146 "2019-11-08T00:42:01Z")
This script has bricked my Pi… the scrypt finished after around an hour with a final “done”. I rebooted and now I’m welcomed with a kernel panic. ---
**Author:** ![Phil\_S\_Zymbit\_1](https://avatars.discourse-cdn.com/v4/letter/p/45deac/32.png) [@Phil\_S\_Zymbit\_1](https://community.zymbit.com/u/Phil_S_Zymbit_1)\ **Post date:** [November 8, 2019, 1:36am UTC](https://community.zymbit.com/t/encrypting-your-root-file-system-on-raspberry-pi-using-luks-dm-crypt/150/147 "2019-11-08T01:36:11Z")
@josenovera which script - URL which PI which SDCard which power supply (it matters because if the Pi is under-powered it slows the CPU and can take much longer to encrypt your sd card - an hour is excessive, it should take 5-10 minutes). ---
**Author:** ![josenovera](https://avatars.discourse-cdn.com/v4/letter/j/50afbb/32.png) [@josenovera](https://community.zymbit.com/u/josenovera)\ **Post date:** [November 8, 2019, 2:46am UTC](https://community.zymbit.com/t/encrypting-your-root-file-system-on-raspberry-pi-using-luks-dm-crypt/150/148 "2019-11-08T02:46:56Z")
Thanks for the quick response Phil. This the raspberry pi hardware that I’m running: [https://www.amazon.ca/gp/product/B07BD4R3WY/ref=ppx\_yo\_dt\_b\_asin\_title\_o05\_s00?ie=UTF8&psc=1](https://www.amazon.ca/gp/product/B07BD4R3WY/ref=ppx_yo_dt_b_asin_title_o05_s00?ie=UTF8&psc=1) The script that I ran was: `curl -G https://s3.amazonaws.com/zk-sw-repo/mk_encr_sd_rfs.sh | sudo bash -s -- -x /dev/sda -m 7` /dev/sda being my usb key and assuming that /dev/mmcblk0p7 is the linux partition. Decided on 7 because fdisk -l looked very similar to user ‘wiill’'s output: Device Boot Start End Sectors Size Id Type /dev/mmcblk0p1 8192 2476562 2468371 1,2G e W95 FAT16 (LBA) /dev/mmcblk0p2 2476563 31116287 28639725 13,7G 5 Extended /dev/mmcblk0p5 2482176 2547709 65534 32M 83 Linux /dev/mmcblk0p6 2547712 2682879 135168 66M c W95 FAT32 (LBA) /dev/mmcblk0p7 2686976 31116287 28429312 13,6G 83 Linux the instructions say that it should take around 40 minutes so I thought it was working properly…additionally no errors occurred during the process. Also, the zymbit was not permanently paired if that matters. ---
**Author:** ![Phil\_S\_Zymbit\_1](https://avatars.discourse-cdn.com/v4/letter/p/45deac/32.png) [@Phil\_S\_Zymbit\_1](https://community.zymbit.com/u/Phil_S_Zymbit_1)\ **Post date:** [November 8, 2019, 3:50am UTC](https://community.zymbit.com/t/encrypting-your-root-file-system-on-raspberry-pi-using-luks-dm-crypt/150/149 "2019-11-08T03:50:23Z")
When you say the “zymbit was not permanently paired” do you mean the lock tab was not cut ? ---
**Author:** ![josenovera](https://avatars.discourse-cdn.com/v4/letter/j/50afbb/32.png) [@josenovera](https://community.zymbit.com/u/josenovera)\ **Post date:** [November 8, 2019, 4:54am UTC](https://community.zymbit.com/t/encrypting-your-root-file-system-on-raspberry-pi-using-luks-dm-crypt/150/150 "2019-11-08T04:54:57Z")
Yeah that’s right, it was still in development mode. ---
**Author:** ![josenovera](https://avatars.discourse-cdn.com/v4/letter/j/50afbb/32.png) [@josenovera](https://community.zymbit.com/u/josenovera)\ **Post date:** [November 8, 2019, 7:54pm UTC](https://community.zymbit.com/t/encrypting-your-root-file-system-on-raspberry-pi-using-luks-dm-crypt/150/151 "2019-11-08T19:54:53Z")
Any idea on what could have gone wrong? Is there another step when the script finishes? Does it matter what distro is installed on the PI? ---
**Author:** ![Phil\_S\_Zymbit\_1](https://avatars.discourse-cdn.com/v4/letter/p/45deac/32.png) [@Phil\_S\_Zymbit\_1](https://community.zymbit.com/u/Phil_S_Zymbit_1)\ **Post date:** [November 12, 2019, 12:44am UTC](https://community.zymbit.com/t/encrypting-your-root-file-system-on-raspberry-pi-using-luks-dm-crypt/150/152 "2019-11-12T00:44:16Z")
Yes it matters which distro you are using. We recommend i) Stretch ii) Buster Which software distribution are you using ? ---
**Author:** ![josenovera](https://avatars.discourse-cdn.com/v4/letter/j/50afbb/32.png) [@josenovera](https://community.zymbit.com/u/josenovera)\ **Post date:** [November 12, 2019, 7:28pm UTC](https://community.zymbit.com/t/encrypting-your-root-file-system-on-raspberry-pi-using-luks-dm-crypt/150/153 "2019-11-12T19:28:46Z")
I’m using Stretch (raspbian v9) ---
**Author:** ![josenovera](https://avatars.discourse-cdn.com/v4/letter/j/50afbb/32.png) [@josenovera](https://community.zymbit.com/u/josenovera)\ **Post date:** [November 13, 2019, 12:30am UTC](https://community.zymbit.com/t/encrypting-your-root-file-system-on-raspberry-pi-using-luks-dm-crypt/150/154 "2019-11-13T00:30:49Z")
After several restores I’m able to run the script without bricking it, but phase 2 never starts. It keeps rebooting back into the SD card with the zymbit flashing quickly as if it was not paired, which makes sense since the script stops zkifc from running. Any way to get this working?? ---
**Author:** ![Bob\_of\_Zymbit](https://avatars.discourse-cdn.com/v4/letter/b/82dd89/32.png) [@Bob\_of\_Zymbit](https://community.zymbit.com/u/Bob_of_Zymbit)\ **Post date:** [November 15, 2019, 7:14am UTC](https://community.zymbit.com/t/encrypting-your-root-file-system-on-raspberry-pi-using-luks-dm-crypt/150/155 "2019-11-15T07:14:37Z")
It sounds like you are running NOOBS. If that’s true, we’ve had issues with other customers that have tried to get the encrypted volumes running on NOOBS configured SD cards. Since we have only tested this script on the non-NOOBS images (e.g. Raspbian Buster Lite or Desktop), we have recommended that our customers use those images. This step has always solved their problems. ---
**Author:** ![josenovera](https://avatars.discourse-cdn.com/v4/letter/j/50afbb/32.png) [@josenovera](https://community.zymbit.com/u/josenovera)\ **Post date:** [November 19, 2019, 5:34am UTC](https://community.zymbit.com/t/encrypting-your-root-file-system-on-raspberry-pi-using-luks-dm-crypt/150/156 "2019-11-19T05:34:11Z")
That was it - it worked when running the scripts with only 2 partitions and not the 7 that NOOBS uses. Cheers ---
**Author:** ![msaufyrohmad](https://avatars.discourse-cdn.com/v4/letter/m/82dd89/32.png) [@msaufyrohmad](https://community.zymbit.com/u/msaufyrohmad)\ **Post date:** [February 21, 2020, 6:20pm UTC](https://community.zymbit.com/t/encrypting-your-root-file-system-on-raspberry-pi-using-luks-dm-crypt/150/157 "2020-02-21T18:20:46Z")
hi all, my zymbit seems to be unstable. i dont know why. sometime the blink is like before binding sometime the blink is ok and in bind condition. (blink every 3 second). its because of the power voltage goes under 4.75V? because the red led on my rpi stop blinking. i try the sd encryption but fail. zymbit not found. i hope can get some help saufy ---
**Author:** ![Phil\_S\_Zymbit\_1](https://avatars.discourse-cdn.com/v4/letter/p/45deac/32.png) [@Phil\_S\_Zymbit\_1](https://community.zymbit.com/u/Phil_S_Zymbit_1)\ **Post date:** [February 21, 2020, 7:01pm UTC](https://community.zymbit.com/t/encrypting-your-root-file-system-on-raspberry-pi-using-luks-dm-crypt/150/158 "2020-02-21T19:01:43Z")
@msaufyrohmad Yes it sounds like power could be the cause of your problems. Let me explain: 1. If the red LED on the Pi is blinking, or not illuminated, then your Pi is likely not getting enough power and you will need a better power supply. (“better” meaning more power capacity). [Learn About Power Quality on Pi\>](https://community.zymbit.com/t/power-quality-how-it-impacts-software-system-reliability/243) 2. During encryption, the Pi generally consumes a lot of power (its compute intensive to initially encrypt the file system). If the power quality is poor, then the Pi can behave in ways that will slow or completely stall the encryption process: a) when power quality is marginal, the Pi can reduce its clock speed to reduce power consumption - this slows the encryption process, dramatically b) when power quality is poor, then Pi can reset, breaking the encryption process entirely. Try a better power supply, it will likely fix your issues. ---
**Author:** ![msaufyrohmad](https://avatars.discourse-cdn.com/v4/letter/m/82dd89/32.png) [@msaufyrohmad](https://community.zymbit.com/u/msaufyrohmad)\ **Post date:** [February 22, 2020, 1:01pm UTC](https://community.zymbit.com/t/encrypting-your-root-file-system-on-raspberry-pi-using-luks-dm-crypt/150/159 "2020-02-22T13:01:26Z")
hi phil, yes. i bought new adaptor and the process progressing. around 40 minutes i take the second option to convert external drive to LUKS drive. i reboot but hang at initramfs. cryptsetup: WARNING: cryptfs: ignoring unknown option ‘timeout’ UUID:xxxxxxxxxx i remove the usb and the same happening. help me. thnks saufy ---
**Author:** ![iesplin](https://avatars.discourse-cdn.com/v4/letter/i/7bcc69/32.png) [@iesplin](https://community.zymbit.com/u/iesplin)\ **Post date:** [February 26, 2020, 6:01am UTC](https://community.zymbit.com/t/encrypting-your-root-file-system-on-raspberry-pi-using-luks-dm-crypt/150/160 "2020-02-26T06:01:57Z")
Hi, I’ve been testing disk encryption using a Zymkey 4i with a Raspberry Pi 4B and Ubuntu 18.04.4 64-bit. There are a couple differences in the boot process for Ubuntu that prevented the current scripts from working as is. - Ubuntu doesn’t store the kernel command line string in cmdline.txt. Instead the script needs to check the cmdline option in config.txt to get the correct file. Affects both mk\_encr\_sd\_rfs.sh and mk\_encr\_ext\_rfs.sh. - Ubuntu hangs during boot up when using root=PARTUUID in the kernel command line, however will boot ok when using UUID. Affects mk\_encr\_sd\_rfs.sh. Below are modified versions of the scripts that implement changes for these issues: [mk\_encr\_sd\_rfs.sh](https://gist.github.com/iesplin/8dbc325fe93d8e869f22c42185a0f80e) [mk\_encr\_ext\_rfs.sh](https://gist.github.com/iesplin/d321326d744499efd2273a3680b1dff5) ---
**Author:** ![pragya015](https://avatars.discourse-cdn.com/v4/letter/p/f14d63/32.png) [@pragya015](https://community.zymbit.com/u/pragya015)\ **Post date:** [March 4, 2020, 2:03am UTC](https://community.zymbit.com/t/encrypting-your-root-file-system-on-raspberry-pi-using-luks-dm-crypt/150/161 "2020-03-04T02:03:25Z")
Where(path) are the encrypted keys located in the boot partition ? If I load the boot section of SD card on a computer, where would I find them ? If I understand correctly, the encrypted keys should be present somewhere in the boot partition, since the bootloader needs to present it to zymkey module to get the plaintext keys. [Previous page](https://community.zymbit.com/t/encrypting-your-root-file-system-on-raspberry-pi-using-luks-dm-crypt/150.md?page=7) [Next page](https://community.zymbit.com/t/encrypting-your-root-file-system-on-raspberry-pi-using-luks-dm-crypt/150.md?page=9)