dm-crypt is a transparent block device encryption subsystem in Linux kernel versions 2.6 and later and in DragonFly BSD.

Unlike its predecessor cryptoloop, dm-crypt was designed to support advanced modes of operation, such as XTS, LRW and ESSIV, in order to avoid watermarking attacks.

These distributions use initrd to prompt the user to enter a passphrase at the console, or insert a smart card prior to the normal boot process.

Because it lacks a "salt", using cryptsetup is less secure in this mode than is the case with Linux Unified Key Setup (LUKS).

[1] Support for ESSIV (encrypted salt-sector initialization vector) was introduced in Linux kernel version 2.6.10, LRW in 2.6.20 and XTS in 2.6.24.

The Linux Crypto API includes support for most popular block ciphers and hash functions, which are all usable with dm-crypt.

Crypted FS support include LUKS (versions 1 and 2) volumes, loop-AES, TrueCrypt/VeraCrypt (since Linux kernel 3.13),[13][14][15] and BitLocker-encrypted NTFS (since cryptsetup 2.3.0).