I am looking to run my laptop system with a dual boot configuration (Fedora + Windows) with full disk encryption.
I have a laptop that I will be bringing with me while traveling, both domestically and abroad. For obvious reasons, I would like to encrypt the hard disk. The system in question has one 128GB SSD with both Fedora 27 and Windows 7 installed on it in a dual boot configuration.
In this configuration, the hard drive is partitioned as follows:
- sda1 (500MB): Windows Bootloader (System Reserved)
- sda2 (73.8GB): Windows System (C:)
- sda3 (250MB): Grub Bootloader (/boot)
- sda4 (39.8GB): Linux System (/)
- sda5 (5GB): Linux Swap (/swap)
The boot process proceeds as follows:
UEFI | V Grub -> Fedora | V WinBootloader -> Windows 7
In an ideal world, I would like to introduce a third boot loader, loaded before Grub, that handles the decryption of the system partitions. This way all the system partitions, including Grub, can be decrypted using one password.
- While I described a fully installed and configured system, I can format and reinstall if necessary
- Dual booting is a necessity as I need Fedora for work and Windows for CAD programs.
- Platform-specific applications aside, personal user data (files, meta, etc) will be virtually identical under both OS's as everything is synced with cloud services
- I would like to avoid using closed-source solutions (i.e. Bitlocker)
- I would prefer to encrypt both OS's using one solution rather than having an independent solution for each
- Hardware encryption using BIOS/UEFI is not acceptable as I don't want to risk losing data if my motherboard dies
- The Vera/Truecrypt system volume encryption wizard (under Windows, it isn't available under Linux) claims not to support system volume encryption on systems with more than one bootloader
- Vera/Truecrypt are the potential solutions I've found, but if there are better ones I am happy to learn
Is what I am attempting possible? If it is, what are some resources that might help me implement it? Regardless of whether it is or isn't possible, is there a better solution?