According to http://16s.us/Linux/dm-crypt.txt, it's better to use only dm-crypt, because LUKS leaves a trace.That's OK. But, what are the most secure cryptsetup parameters to use? E.g.: aes-cbc-essiv:sha512 is better then the default. Also the default cryptsetup uses 256bit AES, but it could be (max?) 512bit. Which parameters create an encrypted partition with the most security?
What are the most secure cryptsetup parameters to create an Encrypted filesystem?
security
Hiding the fact that you are using encryption is very hard. Consider that some minimal decryption software (like in initrd) must be stored in plain text somewhere. Seeing that and a disk full of random data people might find out.If you can't prevent that you might as well take advantage of LUKS. For example if you have multiple users they can have their own password.About the cipher modes and algorithms. AES is the most widely used algorithm and it supports 128, 192 and 256 bit keys. None of them are even close to being broken. CBC means cipher block chaining. It should not be used for disk encryption because it is vulnerable to watermarking. Use the XTS mode instead. Essiv means that the IV is secret too. This also prevents watermarking. SHA512 is a hashing algorithm used to generate the encryption key from the password. It is considered secure.You may want to look at loop-aes. It has no header, uses multiple 64x256 bit keys and you can use an external disk (like a pendrive) for storing the keys encrypted with your password. Unfortunately it requires kernel patching.BTW I agree with the comments. There is no most secure way. Think about what are you trying to protect and what kind of attacks do you expect.