5

When preparing to encrypt an entire partition, is it better to rely on "native" whole-disk encryption (eg following this tutorial), or an external tool like TrueCrypt?

The wikipedia article comparing disk encryption tools doesn't seem overly helpful to me in working towards a decision.

  • 1
    Worth to mention that today TrueCrypt is dead, on their main page: “WARNING: Using TrueCrypt is not secure as it may contain unfixed security issues”. Some details can be looked up by googling about it, but no much is out there yet, security experts still don't know why the decision was made by TrueCrypt devs. – Radu Maris Feb 20 '15 at 9:12
  • @RaduMaris - thanks for that: I had not seen they were no longer working on the project. – warren Feb 20 '15 at 16:41
  • Truecrypt code is fine. See here grc.com/misc/truecrypt/truecrypt.htm or this replacement veracrypt.fr/en/Home.html – Deleet Aug 19 at 6:06
5

The only thing TrueCrypt gains you is portability. Windows, Mac OS X, and Linux all have a version of TrueCrypt available for download and easy install from http://www.truecrypt.org/. TrueCrypt support is in dm-crypt 1.6+ now which gives Linux native TrueCrypt support out of the box, but you'll have to have a distribution that includes it or install it yourself. Provided you use a compatible file system (FAT32 works on all of them for sure, NTFS with read-only support for Mac OS X by default, and exFAT support works with Linux with the installation of the exfat-fuse package), you can carry a TrueCrypt container and expect to be able to use it on any of the major operating systems seamlessly.

On the other hand, dm-crypt is not as portable to other operating systems, but does everything TrueCrypt does and provides the flexibility of using any algorithm the kernel supports. dm-crypt comes with every Linux distribution and should work out of the box. For Windows, you will need FreeOTFE to mount dm-crypt volumes. You might run into issues with 64-bit Windows along the way. As far as I know, there isn't a FreeOTFE-equivalent for Mac OS X; accessing a dm-crypt volume basically requires installing Linux itself. It's not worth the potential hassle to try and use dm-crypt volumes from other systems if you ask me.

Short answer: if you do not expect to use a volume on other operating systems, stick with native dm-crypt since you'll get support for it straight out of today's live Linux discs. Otherwise, use Truecrypt and FAT32/NTFS.

  • You give the impression that Windows, OSX and Linux have native Truecrypt support, and I'm quite sure this isn't the case. – SPRBRN Apr 18 '14 at 8:22
  • 1
    @rxt: I've made major clarifications and added many links. I don't think this one will mislead anyone into thinking that Windows, Mac OS X, and Linux all support TrueCrypt natively. I do want to give the impression, though, that TrueCrypt is much easier to use for the purposes of portability — certainly more so than dm-crypt/FreeOTFE. – Kevin Li Apr 18 '14 at 11:13
  • 2
    note, however, that cryptsetup does not contain the ability to create TrueCrypt volumes, only mount them. – strugee Apr 19 '14 at 1:17
  • If I'm not mistaken, full disk encryption is still more secure, because you are assured that no (software) backdoors have been inserted into your system which could in turn compromise the security of your disk images? – Michael Jan 30 '15 at 23:52
1

TrueCrypt supports deniability. If you need it, it's your best choice. It is also popular enough that it is undergoing an independent security review.

  • 3
    1) Truecrypt is deniable only in the cryptographic sense. Everybody and their dog knows about the hidden partion these days, so in the real-world sense, it's not deniable. 2) Truecrypt is currently undergoing its first-ever security audit. – Mark Apr 18 '14 at 3:13
  • 1
    Deniability - what use is it? I always wonder. So I have a 1GB TC volume with a hidden volume inside. First I need to put some files in the parent volume to make it appear like it is used. Can those files ever be changed or is it possible to ever add new files to it? Won't those files overwrite the hidden volume? – SPRBRN Apr 18 '14 at 8:25
  • Some people use the parent file system, by being careful how much they add. Yes, it can overwrite your nested file systems without notice. I'm not sure of all the uses, but it's important enough to some people – John Deters Apr 19 '14 at 6:50
  • 1
    @SPRBRN, it is possible to change the decoy files by mounting TrueCrypt with knowledge of all the partitions. – Ángel Nov 3 '14 at 21:26
  • So if you mount both, the parent partition won't overwrite the hidden one? That sounds reasonable and good enough to use both. – SPRBRN Nov 4 '14 at 8:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.