I've gathered that persistent storage in Tails uses LUKS, but I can't find the specifics of the encryption, e.g. the algorithm.
Most of the Tails website and other various places is scant with details. The most in-depth page on Tails' website that I've found is this one, and it just says that it uses LUKS.
tails-persistence-setup --verbose didn't mention LUKS or any specifics at all really.
I've tried peeking at the source code, but it's written in Perl (which I'm not familiar with). The furthest I got in following the logic of the source code is to this here line which I think is just before the encrypted filesystem is created in
Format or something (I don't know Perl).
I searched for instances of "aes", "twofish", "serpent", "128", "256", "512", "xts", "cbc", and "luks" in the files in this source directory and its sub-directories (
/usr/share/perl5/Tails/Persistence on the Tails filesystem), but nothing fruitful came of it. I can't find the details of persistence encryption anywhere in the Tails source code or on Tails while it's running.
If you know the answer pls spill the beans
Edit: After more digging, I found this sentence in the UDisks reference manual:
If the option encrypt.passphrase is given then a LUKS device is created with the given passphrase and the file system is created on the unlocked device. The unlocked device will be left open. This parameter can be used to supply the binary contents of an arbitrary keyfile by passing a value of type “ay”. Option encrypt.type can be used to specify encryption "technology" that will be used. Currently only “luks1” and “luks2” are supported.
encrypt.passphrase is given in Setup.pm, so
encrypt.type is either "luks1" or "luks2".
In the udisks source, this is where the encryption happens. But right now I still don't know what "luks1" and "luks2" mean for encryption specs.
Edit 2: Running this command gave some information about a persistent storage created on Tails 4.4:
sudo cryptsetup status luks*
type: LUKS1 cipher: aes-xts-plain64 keysize: 512 bits key location: dm-crypt sector size: 512 offset: 4096 sectors