Does using both GPG encrypted files and encrypted filesystem make sense?

Question

For a few years i stored my personal text files encrypted using an asymmetric key through GnuPG. Now i thought that it is a good idea to also encrypt my hard drive partition. Does it make sense to use both filesystem encryption (via, say, dm-crypt) and encryption via GPG for separate files? If this is unnecessary, what should i stick with for personal encryption of textual data?

I want to be able to use version control system and text processing tools on these files and also optionally apply steganography to conceal the existence of the files from intruders altogether.

I use GNU/Linux.

Answer 1

If your requirement is,

I want to use version control system with these files and possibly apply steganography to conceal the existence of the files from intruders altogether.

then of course GPG'ing single files only isn't enough. You should encrypt and maybe even plausibly-deny the whole partition with something like TrueCrypt. Does this make sense? Only you can tell.

Once the partition is encrypted and hidden, does it make sense to have the files encrypted one by one? This depends on how a hypothetical attacked might gain access to the system.

The first level of access would be partition access.

This may be gained through straight key recovery (e.g., rubber hose attack, post-it attack) for a standalone system; on a connected system, once you allowed partition access to access your disk, the partition could be readable to a number of services with access to and from the outside, and this access could be compromised.

In a scenario which your level of wariness makes look farfetched, you might have forgotten a network share with weak password. Once the disk is unlocked, the share would then allow access to the plaintext files.

This, I think, is the only scenario wherein double encryption makes sense. The lead pipe attack scenario would naturally imply that access to the second layer might be secured with another judicious application of the same pipe, unless you went to the extremes of supplying a dead-man or kamikaze access (e.g., the unlocking mechanism on the external 'undeniable' partition also triggers a background filling of the partition, thereby trashing the hidden partition) AND the attacker hadn't thought of doing a low-level backup copy of the encrypted medium. The combined likelihood of these two events makes this a dark horse, in my opinion.

A more likely variation of the remote access scenario is that you have the need to run some service on the system, you need this service to have read access to some files that must be kept on the encrypted partition, you can't move these files to a separate, expendable and maybe even unencrypted partition, AND this service has a security vulnerability of which you are unaware.

To protect against this possibility, I believe you have no recourse except to doubly encrypt the files. Of course the service can't have access to the same encrypted files with the same general key, or exploiting the service would secure secondary level access to everything: you will have to use two separate keys, and if the same files need to be access from within and outside the service, you'll have to maintain two separate copies - or use two separate keys from outside the service, i.e.:

INNER ACCESS (key1) ---> file1_1, file2_1 <--- SERVICE (key1)
INNER ACCESS (key2) ---> file3_2, file4_2

or

                         file1_1, file2_1 <--- SERVICE (key1)
INNER ACCESS (key2) ---> file1_2, file2_2,
                         file3_2, file4_2

However, this all depends on your situation. There's no one-size-fits-all guideline that I know of...

Answer 2

GnuPG and an encrypted filesystem do not do the same things and are applied at distinct levels, so using both makes sense.

Some differences:

• Encrypted filesystems (or partitions) apply encryption on all files, transparently, and need no special support from applications. On the other hand, a GnuPG-encrypted file must be explicitly decrypted before access. If you have sensitive data files and you want to open these files with some applications, then you should make sure that the file is never stored as cleartext anywhere on the harddisk. So, if you use GnuPG but no encrypted filesystem, then you should decrypt the file only into a RAM-based disk (tmpfs on Linux, with swap deactivated, to ensure that the data never hits the disk); also, take care of applications which create temporary files with copies of the data.

• Encrypted filesystems protect the file storage, but, from the point of view of the application, the files "are there" and the system does the decryption automatically. At boot time, you type a password to unlock the thing, but, as long as you do anything on the machine, chances are that the partition remains unlocked. If an attacker gains a bit of control on your system at that point, then he can read all your files (that is, the only protection at that point is the OS access rights, not the encryption). GnuPG-encrypted files get decrypted only when you decide so and give you finer-grained control.

• A GnuPG-encrypted file can travel. You can put it on a USB-disk or send it by email, and it stays safe nonetheless. Encrypted filesystems protect the local storage of files, not the files themselves.