Public note to self: cryptsetup -h ripemd160 -c aes-cbc-essiv:sha256 -s 256 create backup /dev/<whatever>