2

To manage security risks effectively, a non-profit organization has the following high level requirements;

  • Limit access to authorized staff.
  • Sensitive data is only accessible to authorized staff.
  • Data integrity must be maintained.
  • Access to data must be auditable.

As a number of staff work off-site, it's important that data is stored securely both on the device in use as well as media such as DVDs and USB sticks/drives.

Historically the devices have used TrueCrypt full disk encryption. As the devices are being retired and refreshed (donations), there is an opportunity to inform the choice and solution to protect the devices.

The staff will be transitioned to Microsoft Windows 10 and OpenSUSE. Deployment of Windows 10 devices is limited due to budgetary considerations. Not all devices support TPM. There are approximately 50 devices of which the majority are non-Windows. Additionally, the editions of Microsoft Windows will be either Home or Professional.

In addition to Veracrypt, there is the option to use Microsoft Bitlocker and LUKS. In researching online, (Full disk options for example), there doesn't appear to be a clear view of the use cases in which the options are best suited for.

For example;

  1. Should Veracrypt be limited to encrypting removable media?
  2. When should LUKS be considered?
7
  • Note that VeraCrypt does not protect integrity, only confidentiality. It is possible to randomize data on the drive with 16-byte precision. However, you can use LUKS with authenticated encryption.
    – forest
    Dec 30, 2018 at 4:36
  • @forest -I would presume that there may be other ways to ensure integrity in addition to confidentiality i.e. If Veracrypt cannot attest to it natively, can it be coupled with another solution?
    – Motivated
    Dec 30, 2018 at 4:43
  • That depends on if you plan on ever modifying the contents in the volume, or if it's write-once.
    – forest
    Dec 30, 2018 at 4:43
  • Just a small (un)related note: I'm not sure you can use Home licenses in a professional environment according to MS ToS.
    – Nomad
    Jan 29, 2019 at 8:31
  • Why not stick to TC ? It was never cracked and works faster than VC.
    – Overmind
    Jan 29, 2019 at 8:57

1 Answer 1

2

You should use LUKS2 with authenticated encryption. You can format a device for this by running:

cryptsetup luksFormat --type luks2 $dev --cipher chacha20-random --integrity poly1305

You specified that data integrity is a requirement. In that case, you should not go with VeraCrypt, as it does not provide full integrity. It uses a mode of operation called XTS which is not great on its own. It is also malleable, which means someone can modify the plaintext by modifying the ciphertext without knowing the key. However, they are limited to only randomizing 16-byte chunks of data. That is, modifying a single bit in the ciphertext results in 16 bytes of plaintext being randomized without VeraCrypt noticing. When you use LUKS2 with authenticated encryption, this issue is mitigated and integrity is protected.

Now, does VeraCrypt have any use-cases that LUKS does not? Sure. VeraCrypt is easier to get working under Windows than LUKS, but the biggest benefit is plausible deniability. If you are in a situation where you have an external encrypted drive and someone is demanding that you disclose the password, you can claim that the drive was wiped and does not contain encrypted data if you use VeraCrypt. If you use LUKS, this will not be possible as it contains a header specifying that it is LUKS. VeraCrypt also has the additional benefit of supporting hidden volumes, which can be useful in certain repressive regimes.

Note that plausible deniability and hidden volumes may not work effectively on solid state media.

2
  • Under what scenarios can someone modify plaintext if they full disk encryption is in place? Additionally, what are the use cases that LUKS is best suited for as is Veracrypt?
    – Motivated
    Dec 30, 2018 at 4:46
  • @Motivated With XTS, they can only randomize the plaintext with 16-byte precision. It is not nearly as malleable as, say, CTR (where you can toggle individual plaintext bits by toggling their ciphertext bits) or plain CBC, but it is still not an authenticated mode by itself. That's why it's important to use AEAD.
    – forest
    Dec 30, 2018 at 4:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .