Let’s have a look at the options available when you select encryption via Device-mapper (dm-crypt) . As always: when in doubt, use the defaults, because they have been carefully chosen with security in mind. 

## Encryption: aes 

This option lets you select the encryption algorithm ( cipher ) which will be used to encrypt the data on the partition. debian-installer currently supports the following block ciphers: aes , blowfish , serpent , and twofish . It is beyond the scope of this document to discuss the qualities of these different algorithms, however, it might help your decision to know that in 2000, AES was chosen by the American National Institute of Standards and Technology as the standard encryption algorithm for protecting sensitive information in the 21st century. 

## Key size: 256 

Here you can specify the length of the encryption key. With a larger key size, the strength of the encryption is generally improved. On the other hand, increasing the length of the key usually has a negative impact on performance. Available key sizes vary depending on the cipher. 

## IV algorithm: xts-plain64 

The Initialization Vector or IV algorithm is used in cryptography to ensure that applying the cipher on the same clear text data with the same key always produces a unique cipher text . The idea is to prevent the attacker from deducing information from repeated patterns in the encrypted data. 

From the provided alternatives, the default xts-plain64 is currently the least vulnerable to known attacks. Use the other alternatives only when you need to ensure compatibility with some previously installed system that is not able to use newer algorithms. 

## Encryption key: Passphrase 

Here you can choose the type of the encryption key for this partition. 

## Passphrase 

The encryption key will be computed 6 on the basis of a passphrase which you will be able to enter later in the process. 

## Random key 

A new encryption key will be generated from random data each time you try to bring up the encrypted partition. In other words: on every shutdown the content of the partition will be lost as the key is deleted from memory. (Of course, you could try to guess the key with a brute force attack, but unless there is an unknown weakness in the cipher algorithm, it is not achievable in our lifetime.) 

Random keys are useful for swap partitions because you do not need to bother yourself with remembering the passphrase or wiping sensitive information from the swap partition before shutting down your computer. However, it also means that you will not be able to use the “suspend-to-disk” functionality offered by newer Linux kernels as it will be impossible (during a subsequent boot) to recover the suspended data written to the swap partition. 

