diff --git a/Makefile.util.def b/Makefile.util.def
index 693a7d127..ffa7a794f 100644
--- a/Makefile.util.def
+++ b/Makefile.util.def
@@ -23,6 +23,7 @@ library = {
   common = grub-core/kern/partition.c;
   common = grub-core/lib/crypto.c;
   common = grub-core/disk/luks.c;
+  common = grub-core/disk/cryptodisk.c;
   common = grub-core/disk/AFSplitter.c;
   common = grub-core/lib/pbkdf2.c;
   common = grub-core/commands/extcmd.c;
diff --git a/grub-core/Makefile.core.def b/grub-core/Makefile.core.def
index 8dc810200..c55fff13a 100644
--- a/grub-core/Makefile.core.def
+++ b/grub-core/Makefile.core.def
@@ -768,6 +768,11 @@ module = {
   common = disk/loopback.c;
 };
 
+module = {
+  name = cryptodisk;
+  common = disk/cryptodisk.c;
+};
+
 module = {
   name = luks;
   common = disk/luks.c;
diff --git a/grub-core/disk/luks.c b/grub-core/disk/luks.c
index a9590cab5..361beb756 100644
--- a/grub-core/disk/luks.c
+++ b/grub-core/disk/luks.c
@@ -16,6 +16,7 @@
  *  along with GRUB.  If not, see <http://www.gnu.org/licenses/>.
  */
 
+#include <grub/cryptodisk.h>
 #include <grub/types.h>
 #include <grub/misc.h>
 #include <grub/mm.h>
@@ -25,15 +26,6 @@
 #include <grub/crypto.h>
 #include <grub/extcmd.h>
 #include <grub/i18n.h>
-#ifdef GRUB_UTIL
-#include <errno.h>
-#include <sys/types.h>
-#include <sys/stat.h>
-#include <fcntl.h>
-#include <grub/emu/hostdisk.h>
-#include <unistd.h>
-#include <string.h>
-#endif
 
 GRUB_MOD_LICENSE ("GPLv3+");
 
@@ -69,59 +61,6 @@ struct grub_luks_phdr
 
 typedef struct grub_luks_phdr *grub_luks_phdr_t;
 
-typedef enum
-  {
-    GRUB_LUKS_MODE_ECB,
-    GRUB_LUKS_MODE_CBC,
-    GRUB_LUKS_MODE_PCBC,
-    GRUB_LUKS_MODE_XTS,
-    GRUB_LUKS_MODE_LRW
-  } luks_mode_t;
-
-typedef enum
-  {
-    GRUB_LUKS_MODE_IV_NULL,
-    GRUB_LUKS_MODE_IV_PLAIN,
-    GRUB_LUKS_MODE_IV_PLAIN64,
-    GRUB_LUKS_MODE_IV_ESSIV,
-    GRUB_LUKS_MODE_IV_BENBI,
-  } luks_mode_iv_t;
-
-/* Our irreducible polynom is x^128+x^7+x^2+x+1. Lowest byte of it is:  */
-#define GF_POLYNOM 0x87
-#define GF_SIZE 128
-#define GF_BYTES (GF_SIZE / 8)
-#define GF_PER_SECTOR (GRUB_DISK_SECTOR_SIZE / GF_BYTES)
-
-struct grub_luks
-{
-  char *source;
-  grub_uint32_t offset;
-  grub_disk_t source_disk;
-  int ref;
-  grub_crypto_cipher_handle_t cipher;
-  grub_crypto_cipher_handle_t secondary_cipher;
-  grub_crypto_cipher_handle_t essiv_cipher;
-  const gcry_md_spec_t *essiv_hash, *hash;
-  luks_mode_t mode;
-  luks_mode_iv_t mode_iv;
-  int benbi_log;
-  unsigned long id, source_id;
-  enum grub_disk_dev_id source_dev_id;
-  char uuid[sizeof (((struct grub_luks_phdr *) 0)->uuid) + 1];
-  grub_uint8_t lrw_key[GF_BYTES];
-  grub_uint8_t *lrw_precalc;
-#ifdef GRUB_UTIL
-  char *cheat;
-  int cheat_fd;
-#endif
-  struct grub_luks *next;
-};
-typedef struct grub_luks *grub_luks_t;
-
-static grub_luks_t luks_list = NULL;
-static grub_uint8_t n = 0;
-
 gcry_err_code_t AF_merge (const gcry_md_spec_t * hash, grub_uint8_t * src,
 			  grub_uint8_t * dst, grub_size_t blocksize,
 			  grub_size_t blocknumbers);
@@ -133,249 +72,13 @@ static const struct grub_arg_option options[] =
     {0, 0, 0, 0, 0, 0}
   };
 
-static void
-gf_mul_x (grub_uint8_t *g)
-{
-  int over = 0, over2 = 0;
-  int j;
-
-  for (j = 0; j < GF_BYTES; j++)
-    {
-      over2 = !!(g[j] & 0x80);
-      g[j] <<= 1;
-      g[j] |= over;
-      over = over2;
-    }
-  if (over)
-    g[0] ^= GF_POLYNOM;
-}
-
-
-static void
-gf_mul_x_be (grub_uint8_t *g)
-{
-  int over = 0, over2 = 0;
-  int j;
-
-  for (j = GF_BYTES - 1; j >= 0; j--)
-    {
-      over2 = !!(g[j] & 0x80);
-      g[j] <<= 1;
-      g[j] |= over;
-      over = over2;
-    }
-  if (over)
-    g[GF_BYTES - 1] ^= GF_POLYNOM;
-}
-
-static void
-gf_mul_be (grub_uint8_t *o, const grub_uint8_t *a, const grub_uint8_t *b)
-{
-  int i;
-  grub_uint8_t t[GF_BYTES];
-  grub_memset (o, 0, GF_BYTES);
-  grub_memcpy (t, b, GF_BYTES);
-  for (i = 0; i < GF_SIZE; i++)
-    {
-      if (((a[GF_BYTES - i / 8 - 1] >> (i % 8))) & 1)
-	grub_crypto_xor (o, o, t, GF_BYTES);
-      gf_mul_x_be (t);
-    }
-}
-
-static gcry_err_code_t
-grub_crypto_pcbc_decrypt (grub_crypto_cipher_handle_t cipher,
-			 void *out, void *in, grub_size_t size,
-			 void *iv)
-{
-  grub_uint8_t *inptr, *outptr, *end;
-  grub_uint8_t ivt[cipher->cipher->blocksize];
-  if (!cipher->cipher->decrypt)
-    return GPG_ERR_NOT_SUPPORTED;
-  if (size % cipher->cipher->blocksize != 0)
-    return GPG_ERR_INV_ARG;
-  end = (grub_uint8_t *) in + size;
-  for (inptr = in, outptr = out; inptr < end;
-       inptr += cipher->cipher->blocksize, outptr += cipher->cipher->blocksize)
-    {
-      grub_memcpy (ivt, inptr, cipher->cipher->blocksize);
-      cipher->cipher->decrypt (cipher->ctx, outptr, inptr);
-      grub_crypto_xor (outptr, outptr, iv, cipher->cipher->blocksize);
-      grub_crypto_xor (iv, ivt, outptr, cipher->cipher->blocksize);
-    }
-  return GPG_ERR_NO_ERROR;
-}
-
-struct lrw_sector
-{
-  grub_uint8_t low[GF_BYTES];
-  grub_uint8_t high[GF_BYTES];
-  grub_uint8_t low_byte, low_byte_c;
-};
-
-static void
-generate_lrw_sector (struct lrw_sector *sec,
-		     const struct grub_luks *dev,
-		     const grub_uint8_t *iv)
-{
-  grub_uint8_t idx[GF_BYTES];
-  grub_uint16_t c;
-  int j;
-  grub_memcpy (idx, iv, GF_BYTES);
-  sec->low_byte = (idx[GF_BYTES - 1] & (GF_PER_SECTOR - 1));
-  sec->low_byte_c = (((GF_PER_SECTOR - 1) & ~sec->low_byte) + 1);
-  idx[GF_BYTES - 1] &= ~(GF_PER_SECTOR - 1);
-  gf_mul_be (sec->low, dev->lrw_key, idx);
-  if (!sec->low_byte)
-    return;
-
-  c = idx[GF_BYTES - 1] + GF_PER_SECTOR;
-  if (c & 0x100)
-    {
-      for (j = GF_BYTES - 2; j >= 0; j--)
-	{
-	  idx[j]++;
-	  if (idx[j] != 0)
-	    break;
-	}
-    }
-  idx[GF_BYTES - 1] = c;
-  gf_mul_be (sec->high, dev->lrw_key, idx);
-}
-
-static void __attribute__ ((unused))
-lrw_xor (const struct lrw_sector *sec,
-	 const struct grub_luks *dev,
-	 grub_uint8_t *b)
-{
-  int i;
-
-  for (i = 0; i < sec->low_byte_c * GF_BYTES; i += GF_BYTES)
-    grub_crypto_xor (b + i, b + i, sec->low, GF_BYTES);
-  grub_crypto_xor (b, b, dev->lrw_precalc + GF_BYTES * sec->low_byte,
-		   sec->low_byte_c * GF_BYTES);
-  if (!sec->low_byte)
-    return;
-
-  for (i = sec->low_byte_c * GF_BYTES;
-       i < GRUB_DISK_SECTOR_SIZE; i += GF_BYTES)
-    grub_crypto_xor (b + i, b + i, sec->high, GF_BYTES);
-  grub_crypto_xor (b + sec->low_byte_c * GF_BYTES,
-		   b + sec->low_byte_c * GF_BYTES,
-		   dev->lrw_precalc, sec->low_byte * GF_BYTES);
-}
-
-static gcry_err_code_t
-luks_decrypt (const struct grub_luks *dev,
-	      grub_uint8_t * data, grub_size_t len, grub_disk_addr_t sector)
-{
-  grub_size_t i;
-  gcry_err_code_t err;
-
-  /* The only mode without IV.  */
-  if (dev->mode == GRUB_LUKS_MODE_ECB)
-    return grub_crypto_ecb_decrypt (dev->cipher, data, data, len);
-
-  for (i = 0; i < len; i += GRUB_DISK_SECTOR_SIZE)
-    {
-      grub_size_t sz = ((dev->cipher->cipher->blocksize
-			 + sizeof (grub_uint32_t) - 1)
-			/ sizeof (grub_uint32_t));
-      grub_uint32_t iv[sz];
-
-      grub_memset (iv, 0, sz * sizeof (iv[0]));
-      switch (dev->mode_iv)
-	{
-	case GRUB_LUKS_MODE_IV_NULL:
-	  break;
-	case GRUB_LUKS_MODE_IV_PLAIN64:
-	  iv[1] = grub_cpu_to_le32 (sector >> 32);
-	case GRUB_LUKS_MODE_IV_PLAIN:
-	  iv[0] = grub_cpu_to_le32 (sector & 0xFFFFFFFF);
-	  break;
-	case GRUB_LUKS_MODE_IV_BENBI:
-	  {
-	    grub_uint64_t num = (sector << dev->benbi_log) + 1;
-	    iv[sz - 2] = grub_cpu_to_be32 (num >> 32);
-	    iv[sz - 1] = grub_cpu_to_be32 (num & 0xFFFFFFFF);
-	  }
-	  break;
-	case GRUB_LUKS_MODE_IV_ESSIV:
-	  iv[0] = grub_cpu_to_le32 (sector & 0xFFFFFFFF);
-	  err = grub_crypto_ecb_encrypt (dev->essiv_cipher, iv, iv,
-					 dev->cipher->cipher->blocksize);
-	  if (err)
-	    return err;
-	}
-
-      switch (dev->mode)
-	{
-	case GRUB_LUKS_MODE_CBC:
-	  err = grub_crypto_cbc_decrypt (dev->cipher, data + i, data + i,
-					 GRUB_DISK_SECTOR_SIZE, iv);
-	  if (err)
-	    return err;
-	  break;
-
-	case GRUB_LUKS_MODE_PCBC:
-	  err = grub_crypto_pcbc_decrypt (dev->cipher, data + i, data + i,
-					  GRUB_DISK_SECTOR_SIZE, iv);
-	  if (err)
-	    return err;
-	  break;
-	case GRUB_LUKS_MODE_XTS:
-	  {
-	    int j;
-	    err = grub_crypto_ecb_encrypt (dev->secondary_cipher, iv, iv,
-					   dev->cipher->cipher->blocksize);
-	    if (err)
-	      return err;
-	    
-	    for (j = 0; j < GRUB_DISK_SECTOR_SIZE;
-		 j += dev->cipher->cipher->blocksize)
-	      {
-		grub_crypto_xor (data + i + j, data + i + j, iv,
-				 dev->cipher->cipher->blocksize);
-		err = grub_crypto_ecb_decrypt (dev->cipher, data + i + j, 
-					       data + i + j,
-					       dev->cipher->cipher->blocksize);
-		if (err)
-		  return err;
-		grub_crypto_xor (data + i + j, data + i + j, iv,
-				 dev->cipher->cipher->blocksize);
-		gf_mul_x ((grub_uint8_t *) iv);
-	      }
-	  }
-	  break;
-	case GRUB_LUKS_MODE_LRW:
-	  {
-	    struct lrw_sector sec;
-
-	    generate_lrw_sector (&sec, dev, (grub_uint8_t *) iv);
-	    lrw_xor (&sec, dev, data + i);
-
-	    err = grub_crypto_ecb_decrypt (dev->cipher, data + i, 
-					   data + i, GRUB_DISK_SECTOR_SIZE);
-	    if (err)
-	      return err;
-	    lrw_xor (&sec, dev, data + i);
-	  }
-	  break;
-	default:
-	  return GPG_ERR_NOT_IMPLEMENTED;
-	}
-      sector++;
-    }
-  return GPG_ERR_NO_ERROR;
-}
-
 static int check_uuid, have_it;
 static char *search_uuid;
 
-static grub_luks_t
+static grub_cryptodisk_t
 configure_ciphers (const struct grub_luks_phdr *header)
 {
-  grub_luks_t newdev;
+  grub_cryptodisk_t newdev;
   const char *iptr;
   char *optr;
   char uuid[sizeof (header->uuid) + 1];
@@ -387,8 +90,8 @@ configure_ciphers (const struct grub_luks_phdr *header)
   grub_crypto_cipher_handle_t essiv_cipher = NULL;
   const gcry_md_spec_t *hash = NULL, *essiv_hash = NULL;
   const struct gcry_cipher_spec *ciph;
-  luks_mode_t mode;
-  luks_mode_iv_t mode_iv;
+  grub_cryptodisk_mode_t mode;
+  grub_cryptodisk_mode_iv_t mode_iv;
   int benbi_log = 0;
 
   /* Look for LUKS magic sequence.  */
@@ -442,29 +145,29 @@ configure_ciphers (const struct grub_luks_phdr *header)
   /* Configure the cipher mode.  */
   if (grub_strcmp (ciphermode, "ecb") == 0)
     {
-      mode = GRUB_LUKS_MODE_ECB;
-      mode_iv = GRUB_LUKS_MODE_IV_PLAIN;
+      mode = GRUB_CRYPTODISK_MODE_ECB;
+      mode_iv = GRUB_CRYPTODISK_MODE_IV_PLAIN;
       cipheriv = NULL;
     }
   else if (grub_strcmp (ciphermode, "plain") == 0)
     {
-      mode = GRUB_LUKS_MODE_CBC;
-      mode_iv = GRUB_LUKS_MODE_IV_PLAIN;
+      mode = GRUB_CRYPTODISK_MODE_CBC;
+      mode_iv = GRUB_CRYPTODISK_MODE_IV_PLAIN;
       cipheriv = NULL;
     }
   else if (grub_memcmp (ciphermode, "cbc-", sizeof ("cbc-") - 1) == 0)
     {
-      mode = GRUB_LUKS_MODE_CBC;
+      mode = GRUB_CRYPTODISK_MODE_CBC;
       cipheriv = ciphermode + sizeof ("cbc-") - 1;
     }
   else if (grub_memcmp (ciphermode, "pcbc-", sizeof ("pcbc-") - 1) == 0)
     {
-      mode = GRUB_LUKS_MODE_PCBC;
+      mode = GRUB_CRYPTODISK_MODE_PCBC;
       cipheriv = ciphermode + sizeof ("pcbc-") - 1;
     }
   else if (grub_memcmp (ciphermode, "xts-", sizeof ("xts-") - 1) == 0)
     {
-      mode = GRUB_LUKS_MODE_XTS;
+      mode = GRUB_CRYPTODISK_MODE_XTS;
       cipheriv = ciphermode + sizeof ("xts-") - 1;
       secondary_cipher = grub_crypto_cipher_open (ciph);
       if (!secondary_cipher)
@@ -472,14 +175,14 @@ configure_ciphers (const struct grub_luks_phdr *header)
 	  grub_crypto_cipher_close (cipher);
 	  return NULL;
 	}
-      if (cipher->cipher->blocksize != GF_BYTES)
+      if (cipher->cipher->blocksize != GRUB_CRYPTODISK_GF_BYTES)
 	{
 	  grub_crypto_cipher_close (cipher);
 	  grub_error (GRUB_ERR_BAD_ARGUMENT, "Unsupported XTS block size: %d",
 		      cipher->cipher->blocksize);
 	  return NULL;
 	}
-      if (secondary_cipher->cipher->blocksize != GF_BYTES)
+      if (secondary_cipher->cipher->blocksize != GRUB_CRYPTODISK_GF_BYTES)
 	{
 	  grub_crypto_cipher_close (cipher);
 	  grub_error (GRUB_ERR_BAD_ARGUMENT, "Unsupported XTS block size: %d",
@@ -489,9 +192,9 @@ configure_ciphers (const struct grub_luks_phdr *header)
     }
   else if (grub_memcmp (ciphermode, "lrw-", sizeof ("lrw-") - 1) == 0)
     {
-      mode = GRUB_LUKS_MODE_LRW;
+      mode = GRUB_CRYPTODISK_MODE_LRW;
       cipheriv = ciphermode + sizeof ("lrw-") - 1;
-      if (cipher->cipher->blocksize != GF_BYTES)
+      if (cipher->cipher->blocksize != GRUB_CRYPTODISK_GF_BYTES)
 	{
 	  grub_crypto_cipher_close (cipher);
 	  grub_error (GRUB_ERR_BAD_ARGUMENT, "Unsupported LRW block size: %d",
@@ -509,9 +212,9 @@ configure_ciphers (const struct grub_luks_phdr *header)
 
   if (cipheriv == NULL);
   else if (grub_memcmp (cipheriv, "plain", sizeof ("plain") - 1) == 0)
-      mode_iv = GRUB_LUKS_MODE_IV_PLAIN;
+      mode_iv = GRUB_CRYPTODISK_MODE_IV_PLAIN;
   else if (grub_memcmp (cipheriv, "plain64", sizeof ("plain64") - 1) == 0)
-      mode_iv = GRUB_LUKS_MODE_IV_PLAIN64;
+      mode_iv = GRUB_CRYPTODISK_MODE_IV_PLAIN64;
   else if (grub_memcmp (cipheriv, "benbi", sizeof ("benbi") - 1) == 0)
     {
       if (cipher->cipher->blocksize & (cipher->cipher->blocksize - 1)
@@ -521,15 +224,15 @@ configure_ciphers (const struct grub_luks_phdr *header)
       for (benbi_log = 0; 
 	   (cipher->cipher->blocksize << benbi_log) < GRUB_DISK_SECTOR_SIZE;
 	   benbi_log++);
-      mode_iv = GRUB_LUKS_MODE_IV_BENBI;
+      mode_iv = GRUB_CRYPTODISK_MODE_IV_BENBI;
     }
   else if (grub_memcmp (cipheriv, "null", sizeof ("null") - 1) == 0)
-      mode_iv = GRUB_LUKS_MODE_IV_NULL;
+      mode_iv = GRUB_CRYPTODISK_MODE_IV_NULL;
   else if (grub_memcmp (cipheriv, "essiv:", sizeof ("essiv:") - 1) == 0)
     {
       char *hash_str = cipheriv + 6;
 
-      mode_iv = GRUB_LUKS_MODE_IV_ESSIV;
+      mode_iv = GRUB_CRYPTODISK_MODE_IV_ESSIV;
 
       /* Configure the hash and cipher used for ESSIV.  */
       essiv_hash = grub_crypto_lookup_md_by_name (hash_str);
@@ -567,7 +270,7 @@ configure_ciphers (const struct grub_luks_phdr *header)
       return NULL;
     }
 
-  newdev = grub_zalloc (sizeof (struct grub_luks));
+  newdev = grub_zalloc (sizeof (struct grub_cryptodisk));
   if (!newdev)
     return NULL;
   newdev->cipher = cipher;
@@ -580,72 +283,12 @@ configure_ciphers (const struct grub_luks_phdr *header)
   newdev->essiv_cipher = essiv_cipher;
   newdev->essiv_hash = essiv_hash;
   newdev->hash = hash;
-  newdev->id = n++;
   grub_memcpy (newdev->uuid, uuid, sizeof (newdev->uuid));
   return newdev;
 }
 
-static gcry_err_code_t
-luks_setkey (grub_luks_t dev, grub_uint8_t *key, grub_size_t keysize)
-{
-  gcry_err_code_t err;
-  int real_keysize;
-
-  real_keysize = keysize;
-  if (dev->mode == GRUB_LUKS_MODE_XTS)
-    real_keysize /= 2;
-  if (dev->mode == GRUB_LUKS_MODE_LRW)
-    real_keysize -= dev->cipher->cipher->blocksize;
-	
-  /* Set the PBKDF2 output as the cipher key.  */
-  err = grub_crypto_cipher_set_key (dev->cipher, key, real_keysize);
-  if (err)
-    return err;
-
-  /* Configure ESSIV if necessary.  */
-  if (dev->mode_iv == GRUB_LUKS_MODE_IV_ESSIV)
-    {
-      grub_size_t essiv_keysize = dev->essiv_hash->mdlen;
-      grub_uint8_t hashed_key[essiv_keysize];
-
-      grub_crypto_hash (dev->essiv_hash, hashed_key, key, keysize);
-      err = grub_crypto_cipher_set_key (dev->essiv_cipher,
-					hashed_key, essiv_keysize);
-      if (err)
-	return err;
-    }
-  if (dev->mode == GRUB_LUKS_MODE_XTS)
-    {
-      err = grub_crypto_cipher_set_key (dev->secondary_cipher,
-					key + real_keysize,
-					keysize / 2);
-      if (err)
-	return err;
-    }
-
-  if (dev->mode == GRUB_LUKS_MODE_LRW)
-    {
-      int i;
-      grub_uint8_t idx[GF_BYTES];
-
-      grub_free (dev->lrw_precalc);
-      grub_memcpy (dev->lrw_key, key + real_keysize,
-		   dev->cipher->cipher->blocksize);
-      dev->lrw_precalc = grub_malloc (GRUB_DISK_SECTOR_SIZE);
-      if (!dev->lrw_precalc)
-	return GPG_ERR_OUT_OF_MEMORY;
-      grub_memset (idx, 0, GF_BYTES);
-      for (i = 0; i < GRUB_DISK_SECTOR_SIZE; i += GF_BYTES)
-	{
-	  idx[GF_BYTES - 1] = i / GF_BYTES;
-	  gf_mul_be (dev->lrw_precalc + i, idx, dev->lrw_key);
-	}
-    }
-  return GPG_ERR_NO_ERROR;
-}
-
 static grub_err_t
-luks_recover_key (grub_luks_t dev, const struct grub_luks_phdr *header,
+luks_recover_key (grub_cryptodisk_t dev, const struct grub_luks_phdr *header,
 		  const char *name, grub_disk_t source)
 {
   grub_size_t keysize = grub_be_to_cpu32 (header->keyBytes);
@@ -700,7 +343,7 @@ luks_recover_key (grub_luks_t dev, const struct grub_luks_phdr *header,
 
       grub_dprintf ("luks", "PBKDF2 done\n");
 
-      gcry_err = luks_setkey (dev, digest, keysize); 
+      gcry_err = grub_cryptodisk_setkey (dev, digest, keysize); 
       if (gcry_err)
 	{
 	  grub_free (split_key);
@@ -721,7 +364,7 @@ luks_recover_key (grub_luks_t dev, const struct grub_luks_phdr *header,
 	  return err;
 	}
 
-      gcry_err = luks_decrypt (dev, split_key, length, 0);
+      gcry_err = grub_cryptodisk_decrypt (dev, split_key, length, 0);
       if (gcry_err)
 	{
 	  grub_free (split_key);
@@ -766,7 +409,7 @@ luks_recover_key (grub_luks_t dev, const struct grub_luks_phdr *header,
       grub_printf ("Slot %d opened\n", i);
 
       /* Set the master key.  */
-      gcry_err = luks_setkey (dev, candidate_key, keysize); 
+      gcry_err = grub_cryptodisk_setkey (dev, candidate_key, keysize); 
       if (gcry_err)
 	{
 	  grub_free (split_key);
@@ -782,7 +425,7 @@ luks_recover_key (grub_luks_t dev, const struct grub_luks_phdr *header,
 }
 
 static void
-luks_close (grub_luks_t luks)
+luks_close (grub_cryptodisk_t luks)
 {
   grub_crypto_cipher_close (luks->cipher);
   grub_crypto_cipher_close (luks->secondary_cipher);
@@ -795,11 +438,12 @@ grub_luks_scan_device_real (const char *name, grub_disk_t source)
 {
   grub_err_t err;
   struct grub_luks_phdr header;
-  grub_luks_t newdev, dev;
+  grub_cryptodisk_t newdev, dev;
 
-  for (dev = luks_list; dev != NULL; dev = dev->next)
-    if (dev->source_id == source->id && dev->source_dev_id == source->dev->id)
-      return GRUB_ERR_NONE;
+  dev = grub_cryptodisk_get_by_source_disk (source);
+
+  if (dev)
+    return GRUB_ERR_NONE;
 
   /* Read the LUKS header.  */
   err = grub_disk_read (source, 0, 0, sizeof (header), &header);
@@ -817,17 +461,7 @@ grub_luks_scan_device_real (const char *name, grub_disk_t source)
       return err;
     }
 
-  newdev->source = grub_strdup (name);
-  if (!newdev->source)
-    {
-      grub_free (newdev);
-      return grub_errno;
-    }
-
-  newdev->source_id = source->id;
-  newdev->source_dev_id = source->dev->id;
-  newdev->next = luks_list;
-  luks_list = newdev;
+  grub_cryptodisk_insert (newdev, name, source);
 
   have_it = 1;
 
@@ -840,7 +474,7 @@ grub_luks_cheat_mount (const char *sourcedev, const char *cheat)
 {
   grub_err_t err;
   struct grub_luks_phdr header;
-  grub_luks_t newdev, dev;
+  grub_cryptodisk_t newdev, dev;
   grub_disk_t source;
 
   /* Try to open disk.  */
@@ -848,12 +482,13 @@ grub_luks_cheat_mount (const char *sourcedev, const char *cheat)
   if (!source)
     return grub_errno;
 
-  for (dev = luks_list; dev != NULL; dev = dev->next)
-    if (dev->source_id == source->id && dev->source_dev_id == source->dev->id)
-      {
-	grub_disk_close (source);	
-	return GRUB_ERR_NONE;
-      }
+  dev = grub_cryptodisk_get_by_source_disk (source);
+
+  if (dev)
+    {
+      grub_disk_close (source);	
+      return GRUB_ERR_NONE;
+    }
 
   /* Read the LUKS header.  */
   err = grub_disk_read (source, 0, 0, sizeof (header), &header);
@@ -861,25 +496,18 @@ grub_luks_cheat_mount (const char *sourcedev, const char *cheat)
     return err;
 
   newdev = configure_ciphers (&header);
-  grub_disk_close (source);
   if (!newdev)
-    return grub_errno;
-
-  newdev->cheat = grub_strdup (cheat);
-  newdev->source = grub_strdup (sourcedev);
-  if (!newdev->source || !newdev->cheat)
     {
-      grub_free (newdev->source);
-      grub_free (newdev->cheat);
-      grub_free (newdev);
+      grub_disk_close (source);
       return grub_errno;
     }
-  newdev->cheat_fd = -1;
-  newdev->source_id = source->id;
-  newdev->source_dev_id = source->dev->id;
-  newdev->next = luks_list;
-  luks_list = newdev;
-  return GRUB_ERR_NONE;
+
+  err = grub_cryptodisk_cheat_insert (newdev, sourcedev, source, cheat);
+  grub_disk_close (source);
+  if (err)
+    grub_free (newdev);
+
+  return err;
 }
 #endif
 
@@ -903,208 +531,16 @@ grub_luks_scan_device (const char *name)
   return have_it && check_uuid ? 0 : 1;
 }
 
-static int
-grub_luks_iterate (int (*hook) (const char *name),
-		   grub_disk_pull_t pull)
-{
-  grub_luks_t i;
-
-  if (pull != GRUB_DISK_PULL_NONE)
-    return 0;
-
-  for (i = luks_list; i != NULL; i = i->next)
-    {
-      char buf[30];
-      grub_snprintf (buf, sizeof (buf), "luks%lu", i->id);
-      if (hook (buf))
-	return 1;
-    }
-
-  return GRUB_ERR_NONE;
-}
-
-static grub_err_t
-grub_luks_open (const char *name, grub_disk_t disk,
-		grub_disk_pull_t pull __attribute__ ((unused)))
-{
-  grub_luks_t dev;
-
-  if (grub_memcmp (name, "luks", sizeof ("luks") - 1) != 0)
-    return grub_error (GRUB_ERR_UNKNOWN_DEVICE, "No such device");
-
-  if (grub_memcmp (name, "luksuuid/", sizeof ("luksuuid/") - 1) == 0)
-    {
-      for (dev = luks_list; dev != NULL; dev = dev->next)
-	if (grub_strcasecmp (name + sizeof ("luksuuid/") - 1, dev->uuid) == 0)
-	  break;
-    }
-  else
-    {
-      unsigned long id = grub_strtoul (name + sizeof ("luks") - 1, 0, 0);
-      if (grub_errno)
-	return grub_error (GRUB_ERR_UNKNOWN_DEVICE, "No such device");
-      /* Search for requested device in the list of LUKS devices.  */
-      for (dev = luks_list; dev != NULL; dev = dev->next)
-	if (dev->id == id)
-	  break;
-    }
-  if (!dev)
-    return grub_error (GRUB_ERR_UNKNOWN_DEVICE, "No such device");
-
 #ifdef GRUB_UTIL
-  if (dev->cheat)
-    {
-      if (dev->cheat_fd == -1)
-	dev->cheat_fd = open (dev->cheat, O_RDONLY);
-      if (dev->cheat_fd == -1)
-	return grub_error (GRUB_ERR_IO, "couldn't open %s: %s",
-			   dev->cheat, strerror (errno));
-    }
-#endif
-
-  if (!dev->source_disk)
-    {
-      grub_dprintf ("luks", "Opening device %s\n", name);
-      /* Try to open the source disk and populate the requested disk.  */
-      dev->source_disk = grub_disk_open (dev->source);
-      if (!dev->source_disk)
-	return grub_errno;
-    }
-
-  disk->data = dev;
-  disk->total_sectors = grub_disk_get_size (dev->source_disk) - dev->offset;
-  disk->id = dev->id;
-  dev->ref++;
-  return GRUB_ERR_NONE;
-}
-
-static void
-grub_luks_close (grub_disk_t disk)
-{
-  grub_luks_t dev = (grub_luks_t) disk->data;
-  grub_dprintf ("luks", "Closing disk\n");
-
-  dev->ref--;
-
-  if (dev->ref != 0)
-    return;
-#ifdef GRUB_UTIL
-  if (dev->cheat)
-    {
-      close (dev->cheat_fd);
-      dev->cheat_fd = -1;
-    }
-#endif
-  grub_disk_close (dev->source_disk);
-  dev->source_disk = NULL;
-}
-
-static grub_err_t
-grub_luks_read (grub_disk_t disk, grub_disk_addr_t sector,
-		grub_size_t size, char *buf)
-{
-  grub_luks_t dev = (grub_luks_t) disk->data;
-  grub_err_t err;
-
-#ifdef GRUB_UTIL
-  if (dev->cheat)
-    {
-      err = grub_util_fd_sector_seek (dev->cheat_fd, dev->cheat, sector);
-      if (err)
-	return err;
-      if (grub_util_fd_read (dev->cheat_fd, buf, size << GRUB_DISK_SECTOR_BITS)
-	  != (ssize_t) (size << GRUB_DISK_SECTOR_BITS))
-	return grub_error (GRUB_ERR_READ_ERROR, "cannot read from `%s'",
-			   dev->cheat);
-      return GRUB_ERR_NONE;
-    }
-#endif
-
-  grub_dprintf ("luks",
-		"Reading %" PRIuGRUB_SIZE " sectors from sector 0x%"
-		PRIxGRUB_UINT64_T " with offset of %" PRIuGRUB_UINT32_T "\n",
-		size, sector, dev->offset);
-
-  err = grub_disk_read (dev->source_disk, sector + dev->offset, 0,
-			size << GRUB_DISK_SECTOR_BITS, buf);
-  if (err)
-    {
-      grub_dprintf ("luks", "grub_disk_read failed with error %d\n", err);
-      return err;
-    }
-  return grub_crypto_gcry_error (luks_decrypt (dev, (grub_uint8_t *) buf,
-					       size << GRUB_DISK_SECTOR_BITS,
-					       sector));
-}
-
-static grub_err_t
-grub_luks_write (grub_disk_t disk __attribute ((unused)),
-		 grub_disk_addr_t sector __attribute ((unused)),
-		 grub_size_t size __attribute ((unused)),
-		 const char *buf __attribute ((unused)))
-{
-  return GRUB_ERR_NOT_IMPLEMENTED_YET;
-}
-
-#ifdef GRUB_UTIL
-static grub_disk_memberlist_t
-grub_luks_memberlist (grub_disk_t disk)
-{
-  grub_luks_t dev = (grub_luks_t) disk->data;
-  grub_disk_memberlist_t list = NULL;
-
-  list = grub_malloc (sizeof (*list));
-  if (list)
-    {
-      list->disk = dev->source_disk;
-      list->next = NULL;
-    }
-
-  return list;
-}
-
-void
-grub_util_luks_print_ciphers (grub_disk_t disk)
-{
-  grub_luks_t dev = (grub_luks_t) disk->data;
-  if (dev->cipher)
-    grub_printf ("%s ", dev->cipher->cipher->modname);
-  if (dev->secondary_cipher)
-    grub_printf ("%s ", dev->secondary_cipher->cipher->modname);
-  if (dev->essiv_cipher)
-    grub_printf ("%s ", dev->essiv_cipher->cipher->modname);
-  if (dev->hash)
-    grub_printf ("%s ", dev->hash->modname);
-  if (dev->essiv_hash)
-    grub_printf ("%s ", dev->essiv_hash->modname);
-}
 
 void
 grub_util_luks_print_uuid (grub_disk_t disk)
 {
-  grub_luks_t dev = (grub_luks_t) disk->data;
+  grub_cryptodisk_t dev = (grub_cryptodisk_t) disk->data;
   grub_printf ("%s ", dev->uuid);
 }
 #endif
 
-static void
-luks_cleanup (void)
-{
-  grub_luks_t dev = luks_list;
-  grub_luks_t tmp;
-
-  while (dev != NULL)
-    {
-      grub_free (dev->source);
-      grub_free (dev->cipher);
-      grub_free (dev->secondary_cipher);
-      grub_free (dev->essiv_cipher);
-      tmp = dev->next;
-      grub_free (dev);
-      dev = tmp;
-    }
-}
-
 static grub_err_t
 grub_cmd_luksmount (grub_extcmd_context_t ctxt, int argc, char **args)
 {
@@ -1116,14 +552,14 @@ grub_cmd_luksmount (grub_extcmd_context_t ctxt, int argc, char **args)
   have_it = 0;
   if (state[0].set)
     {
-      grub_luks_t dev;
+      grub_cryptodisk_t dev;
 
-      for (dev = luks_list; dev != NULL; dev = dev->next)
-	if (grub_strcasecmp (dev->uuid, args[0]) == 0)
-	  {
-	    grub_dprintf ("luks", "already mounted as luks%lu\n", dev->id);
-	    return GRUB_ERR_NONE;
-	  }
+      dev = grub_cryptodisk_get_by_uuid (args[0]);
+      if (dev)
+	{
+	  grub_dprintf ("luks", "already mounted as crypto%lu\n", dev->id);
+	  return GRUB_ERR_NONE;
+	}
 
       check_uuid = 1;
       search_uuid = args[0];
@@ -1146,7 +582,7 @@ grub_cmd_luksmount (grub_extcmd_context_t ctxt, int argc, char **args)
     {
       grub_err_t err;
       grub_disk_t disk;
-      grub_luks_t dev;
+      grub_cryptodisk_t dev;
 
       check_uuid = 0;
       search_uuid = NULL;
@@ -1154,13 +590,13 @@ grub_cmd_luksmount (grub_extcmd_context_t ctxt, int argc, char **args)
       if (!disk)
 	return grub_errno;
 
-      for (dev = luks_list; dev != NULL; dev = dev->next)
-	if (dev->source_id == disk->id && dev->source_dev_id == disk->dev->id)
-	  {
-	    grub_dprintf ("luks", "already mounted as luks%lu\n", dev->id);
-	    grub_disk_close (disk);
-	    return GRUB_ERR_NONE;
-	  }
+      dev = grub_cryptodisk_get_by_source_disk (disk);
+      if (dev)
+	{
+	  grub_dprintf ("luks", "already mounted as luks%lu\n", dev->id);
+	  grub_disk_close (disk);
+	  return GRUB_ERR_NONE;
+	}
 
       err = grub_luks_scan_device_real (args[0], disk);
 
@@ -1170,33 +606,18 @@ grub_cmd_luksmount (grub_extcmd_context_t ctxt, int argc, char **args)
     }
 }
 
-static struct grub_disk_dev grub_luks_dev = {
-  .name = "luks",
-  .id = GRUB_DISK_DEVICE_LUKS_ID,
-  .iterate = grub_luks_iterate,
-  .open = grub_luks_open,
-  .close = grub_luks_close,
-  .read = grub_luks_read,
-  .write = grub_luks_write,
-#ifdef GRUB_UTIL
-  .memberlist = grub_luks_memberlist,
-#endif
-  .next = 0
-};
-
 static grub_extcmd_t cmd;
 
 GRUB_MOD_INIT (luks)
 {
+  COMPILE_TIME_ASSERT (sizeof (((struct grub_luks_phdr *) 0)->uuid)
+		       < GRUB_CRYPTODISK_MAX_UUID_LENGTH);
   cmd = grub_register_extcmd ("luksmount", grub_cmd_luksmount, 0,
 			      N_("SOURCE|-u UUID|-a"),
 			      N_("Mount a LUKS device."), options);
-  grub_disk_dev_register (&grub_luks_dev);
 }
 
 GRUB_MOD_FINI (luks)
 {
   grub_unregister_extcmd (cmd);
-  grub_disk_dev_unregister (&grub_luks_dev);
-  luks_cleanup ();
 }
diff --git a/grub-core/kern/emu/getroot.c b/grub-core/kern/emu/getroot.c
index c3a971689..642d77cf0 100644
--- a/grub-core/kern/emu/getroot.c
+++ b/grub-core/kern/emu/getroot.c
@@ -962,7 +962,7 @@ grub_util_get_grub_dev (const char *os_dev)
 	dash = grub_strchr (uuid + sizeof ("CRYPT-LUKS1-") - 1, '-');
 	if (dash)
 	  *dash = 0;
-	grub_dev = grub_xasprintf ("luksuuid/%s",
+	grub_dev = grub_xasprintf ("cryptouuid/%s",
 				   uuid + sizeof ("CRYPT-LUKS1-") - 1);
 	grub_free (uuid);
       }
diff --git a/include/grub/disk.h b/include/grub/disk.h
index 2678ad5eb..52f3e61b0 100644
--- a/include/grub/disk.h
+++ b/include/grub/disk.h
@@ -42,7 +42,7 @@ enum grub_disk_dev_id
     GRUB_DISK_DEVICE_PXE_ID,
     GRUB_DISK_DEVICE_SCSI_ID,
     GRUB_DISK_DEVICE_FILE_ID,
-    GRUB_DISK_DEVICE_LUKS_ID
+    GRUB_DISK_DEVICE_CRYPTODISK_ID
   };
 
 struct grub_disk;
diff --git a/include/grub/emu/hostdisk.h b/include/grub/emu/hostdisk.h
index 7541308e6..c1350a370 100644
--- a/include/grub/emu/hostdisk.h
+++ b/include/grub/emu/hostdisk.h
@@ -36,7 +36,6 @@ grub_util_fd_sector_seek (int fd, const char *name, grub_disk_addr_t sector);
 ssize_t grub_util_fd_read (int fd, char *buf, size_t len);
 grub_err_t
 grub_luks_cheat_mount (const char *sourcedev, const char *cheat);
-void grub_util_luks_print_ciphers (grub_disk_t disk);
 void grub_util_luks_print_uuid (grub_disk_t disk);
 
 #endif /* ! GRUB_BIOSDISK_MACHINE_UTIL_HEADER */
diff --git a/util/grub-probe.c b/util/grub-probe.c
index 21fc21b02..f5d93ac4e 100644
--- a/util/grub-probe.c
+++ b/util/grub-probe.c
@@ -35,6 +35,7 @@
 #include <grub/raid.h>
 #include <grub/i18n.h>
 #include <grub/crypto.h>
+#include <grub/cryptodisk.h>
 
 #include <stdio.h>
 #include <unistd.h>
@@ -106,7 +107,8 @@ probe_luks_uuid (grub_disk_t disk)
       free (list);
       list = tmp;
     }
-  if (disk->dev->id == GRUB_DISK_DEVICE_LUKS_ID)
+  /* FIXME: support non-LUKS.  */
+  if (disk->dev->id == GRUB_DISK_DEVICE_CRYPTODISK_ID)
     grub_util_luks_print_uuid (disk);
 }
 
@@ -144,11 +146,8 @@ probe_abstraction (grub_disk_t disk)
   if (disk->dev->id == GRUB_DISK_DEVICE_LVM_ID)
     printf ("lvm ");
 
-  if (disk->dev->id == GRUB_DISK_DEVICE_LUKS_ID)
-    {
-      printf ("luks ");
-      grub_util_luks_print_ciphers (disk);
-    }
+  if (disk->dev->id == GRUB_DISK_DEVICE_CRYPTODISK_ID)
+    grub_util_cryptodisk_print_abstraction (disk);
 
   raid_level = probe_raid_level (disk);
   if (raid_level >= 0)