After finally getting a basic, but not-so-straightforward usb key running with the Ubuntu livecd environment (read more here), the next step was to set up encryption on the persistence partition.

This is actually pretty straightforward, given that modernish distributions have inbuilt LUKS support which lets you (amongst other things), easily access encrypted devices.

First thing is first, we'll use the partition on the usb key to create an empty encrypted partition. Because we want to specifically set the partition label, we can't use the helpful luksformat script, instead we take three easy steps:

Create the encrypted block store:
cryptsetup create NAME /dev/sdXN

Open the block store
cryptsetup luksOpen NAME /dev/sdXN

Create filesystem
mkfs -L casper-rw /dev/mapper/NAME

All done! Well, almost. Because the filesystem label lives inside of the encrypted block store - the LiveCD isn't gong to try to mount it or unlock it, and because the casper scripts only use partitions it can see - we won't have a very happy livecd.