When using a laptop, an encrypted HD/SSD can be an important security measure. However, laptops are prone to accidents (fluid spills, dropping on the floor, etc) that may mandate some or all of the components to be replaced.

Are there hard disk encryption schemes that tie the encryption key to other hardware than the HD?

Meaning the drive would be unreadable when it's plugged into a machine other than the (destroyed) original one. Just to avoid them when using a laptop ;-)

  • Why would you tie the encryption key to some hardware part? – F. Hauri Jan 29 '13 at 22:11
  • I don't know and I don't want to. I thought there might some schemes that do it, especially when they use the TPM. That's why I asked this question - just to be sure I can access my data when the rest of the computer is gone. – chiborg Jan 30 '13 at 10:50
  • 1
    If so, most of open-source tools would do the job as you mean, by default. Linking HW to something like salt is possible, but is not usual (it's a not so good idea). Well, @Polynomial answer, like mine, are quite right. – F. Hauri Jan 30 '13 at 11:21

None that I know of. The standard for disk encryption is TrueCrypt, which accepts a password, key files, and smart cards as authentication credentials.

So, at worst, you could use your key files if you put them on a single drive and it fails. Of course, that should be a moot point since you're doing regular backups, right? ;)

  • 3
    TrueCrypt is hardly the standard, even on Windows (there's Bitlocker!). On Linux, it's available but hardly ever used except for containers that must also be accessible from Windows. – Gilles Jan 29 '13 at 14:54
  • 2
    I've often heard it described as the standard, and I don't know of another free open-source cross-platform solution that's as pervasive as TC is. – Polynomial Jan 29 '13 at 14:57

Edited 2015-03-23

As this question was asked by a window user, my answer is not appropriate.

But from time @polynomial answered, his recommendation truecrypt is become unsecured.

Today cryptsetup continue to work fine, but a standard was appeared: LUKS for Linux Unified Key Setup (based on cryptsetup)

... If you really wanna be secured, switch to open-source softwares, like OpenBSD or Debian!

Original post

Under GNU/Linux, there is a standardization effort: cryptsetup

and some (older project) like cryptmount.

Both suites are based on (same) kernel crypto modules and could accept a passphrase. When installed on root file system, the passphrase will be asked at boot (before mounting root /).

Both suites use the block device abstraction layer dm-setup present as standard in Linux kernel from version 2.6.

Quite simple to install, but some linux experience may be useful.

  • And this software is not tying the encryption to some hardware id, right? The passphrase protects the encryption key which is stored somewhere on the hard drive? – chiborg Jan 29 '13 at 17:28
  • Right, however, there was some (older) version of cryptmount who build key from a derivation of passphrase (hash), so passphrase could not be changed. Newer version use a self generated key, protected by the passphrase. But there is no link to hardware ID (not now and not prior)...( Unless you modify mount script ;-) – F. Hauri Jan 29 '13 at 18:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.