Full disk encryption on dual boot system (Truecrypt/Veracrypt)

Question

I am looking to run my laptop system with a dual boot configuration (Fedora + Windows) with full disk encryption.

I have a laptop that I will be bringing with me while traveling, both domestically and abroad. For obvious reasons, I would like to encrypt the hard disk. The system in question has one 128GB SSD with both Fedora 27 and Windows 7 installed on it in a dual boot configuration.

In this configuration, the hard drive is partitioned as follows:

• sda1 (500MB): Windows Bootloader (System Reserved)
• sda2 (73.8GB): Windows System (C:)
• sda3 (250MB): Grub Bootloader (/boot)
• sda4 (39.8GB): Linux System (/)
• sda5 (5GB): Linux Swap (/swap)

The boot process proceeds as follows:

 UEFI
  |
  V
 Grub -> Fedora
  |
  V 
 WinBootloader -> Windows 7

In an ideal world, I would like to introduce a third boot loader, loaded before Grub, that handles the decryption of the system partitions. This way all the system partitions, including Grub, can be decrypted using one password.

Some notes:

• While I described a fully installed and configured system, I can format and reinstall if necessary
• Dual booting is a necessity as I need Fedora for work and Windows for CAD programs.
• Platform-specific applications aside, personal user data (files, meta, etc) will be virtually identical under both OS's as everything is synced with cloud services
• I would like to avoid using closed-source solutions (i.e. Bitlocker)
• I would prefer to encrypt both OS's using one solution rather than having an independent solution for each
• Hardware encryption using BIOS/UEFI is not acceptable as I don't want to risk losing data if my motherboard dies
• The Vera/Truecrypt system volume encryption wizard (under Windows, it isn't available under Linux) claims not to support system volume encryption on systems with more than one bootloader
• Vera/Truecrypt are the potential solutions I've found, but if there are better ones I am happy to learn

The Question(s):

Is what I am attempting possible? If it is, what are some resources that might help me implement it? Regardless of whether it is or isn't possible, is there a better solution?

Answer 1

In an ideal world, I would like to introduce a third boot loader, loaded before Grub, that handles the decryption of the system partitions

As this would be a nice solution, the problem is that a bootloader does not pass a mounted (decrypted) partition to an operating system. It is loading the kernel into memory, starting it and passing a few parameters to it. However, you can encrypt your Grub boot partition and embedded a crypto key into the initramfs for Linux and LUKS (GRUB early crypto disk feature [1]). You could probably implement a similar solution for grub & VeraCrypt & Windows, e.g., grub loads a crypto key file from the encrypted boot partition into memory and VeraCrypt using it later. In that solution, you only have to enter one password during boot. To the best of my knowledge, this does not exist. And if you have mounted your boot partition, your unencrypted keys lie on the partition. So your ideal solution would be only possible with hardware encryption/BIOS/UEFI today.

Alternatively, you could let one party do the encryption for both operating systems, but this only works with virtualization. E.g., you could install Fedora and Windows on a Xen Hypervisor and let Xen do the disk encryption. You probably need non-virtualized hardware in Windows for running CAD programs, but this is not a problem anymore with PCI pass-through [2]. This is pretty complex to set up and requires deeper knowledge in Xen but has the advantage that both systems can run simultaneously. The performance overhead with hardware virtualization is pretty small today. A good starting point is [3].

[1] https://wiki.archlinux.org/index.php/GRUB#Boot_partition
[2] https://wiki.xen.org/wiki/Xen_PCI_Passthrough
[3] https://wiki.xenproject.org/wiki/Xen_Project_Beginners_Guide