<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Analyzing Encryption at Rest

## cryptsetup (LUKS)

| Command | Description |
|---|---|
| `cryptsetup isLuks <device>` | Check if device is LUKS (exit 0 = yes) |
| `cryptsetup luksDump <device>` | Display LUKS header (cipher, key slots) |
| `cryptsetup luksFormat --type luks2 <device>` | Create LUKS volume |
| `cryptsetup luksOpen <device> <name>` | Open/decrypt volume |
| `cryptsetup luksClose <name>` | Close encrypted volume |
| `cryptsetup luksAddKey <device>` | Add key slot |
| `cryptsetup status <name>` | Show active dm-crypt device info |

### Recommended LUKS Parameters

| Parameter | Value |
|---|---|
| `--type` | `luks2` |
| `--cipher` | `aes-xts-plain64` |
| `--key-size` | `512` (256-bit AES in XTS mode) |
| `--hash` | `sha256` |
| `--iter-time` | `5000` (5 seconds) |

## AWS CLI — Encryption Checks

| Command | Description |
|---|---|
| `aws s3api get-bucket-encryption --bucket <name>` | S3 bucket encryption |
| `aws s3api head-object --bucket <b> --key <k>` | Object encryption |
| `aws ec2 describe-volumes --volume-ids <id>` | EBS encryption status |
| `aws rds describe-db-instances --db-instance-identifier <id>` | RDS encryption |
| `aws kms describe-key --key-id <id>` | KMS key details |

### S3 SSE Types

| Type | Description |
|---|---|
| SSE-S3 | Amazon-managed keys |
| SSE-KMS | AWS KMS-managed keys (recommended) |
| SSE-C | Customer-provided keys |

## dmsetup

| Command | Description |
|---|---|
| `dmsetup status --target crypt` | List dm-crypt targets |
| `dmsetup table <name>` | Show device-mapper table |

## Agent Script

```bash
# Check LUKS encryption
node agent.js luks /dev/sda2

# Check S3 bucket encryption
node agent.js s3 my-bucket

# Check EBS volume
node agent.js ebs vol-12345

# Check RDS encryption
node agent.js rds mydb-instance

# Audit dm-crypt volumes
node agent.js dm-crypt
```
