To use tails, I have always used a DVD, because of the fact I know it will not be tampered with, at least within reason. However there are endless reasons why a USB boot option would be faster, and in the current project I am building, it is the only real choice.

Here is what I do not get, and why because it seems so glaringly overlooked, I figure I must be misunderstanding something... When tails installs to a USB drive, why does it not encrypt the partition, and require a pre-boot authentication to protect the drive integrity?

As it stands I can mount the drive on another computer, tinker with it, and make that tails installation compromised.

That way just like any other OS, you cannot side attack the OS with physical possession of the disk without having to break encryption?

I am not finding much chatter on it so again, am I just missing something?

The end result I want is the disk to not boot into my install, or allow mount elsewhere, without having to authenticate first, and if the disk is lost/stolen, borrowed or whatnot... That it is all safely encrypted.

Edit: So after some helpful comments, this seems that it would not work exactly as expected.

So pending not the outcome I had hoped, I could potentially buy small SSDs use GRUB to boot the ISO from inside the drive, that way I could verify the integrity of the ISO file, and that file would be stored on the encrypted side of the disk... Something similar to this.

Optical drives are battery hogs, and if the system could have the secondary battery in that bay, plus the lower power consumption... Well the prototype was working at almost 8.5 hours battery life! That was awesome.

Unfortunately this project's time requirements are likely going to reduce its profit margin to 0 or - which will equal not going to happen...

3 Answers 3


This is a valid question. I believe the OS was originally created to be booted onto a CD/DVD and act as throw away media, that could be used in conjunction with a securely encrypted thumb drive for storage.

There are methods you could use, in fact LVM over LUKS encryption comes to mind (and sounds a lot like what you're asking for) for full system (minus boot partition of course) encryption to ensure the systems integrity and confidentiality (if made persistent) hasn't been compromised. It would also be possible to hash the USBs contents to check for possible tampering.

I imagine the reason this isn't implemented is that it increases the difficulty level for implementation significantly. The average Joe (the people this was originally created for) would probably give up before going through the trouble of encrypting volumes and such, I know that (at least for me) it was quite a pain to implement LVM on LUKs on my Arch system.

In any case, I probably wouldn't trust any media that you handed off to someone else, if you're relying on it to be secure. As far as you knowing your DVD hasn't been tampered with... well I could probably make one that looked just like yours fairly easily if I had direct access to it... Just a thought.

This all comes down to security in-depth, ease of use over security, how far you want to go with it and how paranoid you are about your potential threats.

  • 1
    Booting from an encrypted USB is tricky. LVM over LUKS has been successful but it is very long and involved: infosecramblings.com/backtrack/…
    – schroeder
    Nov 5, 2014 at 23:11
  • 2
    I highly recommend thoroughly reading the Arch Wiki Documentation is you're interested in implementing this (Regardless of the OS). wiki.archlinux.org/index.php/Encryption
    – P0LYmath
    Nov 5, 2014 at 23:16
  • That is what I was afraid of, I have a stack of laptops that came back from our last recycle of our fleet. I was looking at embedding a couple of SD micro cards in readers into a small USB hub, sink the whole thing into resin (it will fit in the HD bay), solder it into the USB bus on the board, and replace the optical drives with extended batteries. Since tails will let you upgrade from a ISO boot, I could re-flash them to current when it was released. If this was possible, it would make a really nice low power consumption, secure system, with friends interested in buying them... Bummer...
    – Sabre
    Nov 6, 2014 at 1:19

This can be achieved a different way by using write-once memory. The problem is that this might not be widely available and might not solve other problems you also have to solve:

  • Optical media with no carrier is hard to 'replace' with evil versions, but encryption does not prevent modification or manipulation like write-once media does

  • USB drives have controllers, EEPROMS and Flash chips, all which are not visible inside the case and can be abused, so encryption by itself isn't enough

  • Encryption only helps against tampering as long as your key doesn't leak, and no modification takes place. When it does, it actually works against you by providing a false sense of security

One way I have tried to do this myself is by cutting the write enable pins off of the chips, but with NAND and FTL controllers this poses a problem since they often have to remap blocks, which then won't be possible and basically destroy the NAND in no-time.

Another method I tried was using SD-cards and CF-cards and physically removing the write lines there, but this posed similar problems as well as still not solving the problems of the embedded controllers still being exploitable with ease. Considering optical drives also have embedded controllers and the motherboard, CPU, PCH etc. also have those, it might be worth establishing your threat model first. If you can assume nobody has messed with your hardware, then maybe a USB drive with a write-protect switch might be enough.

To drive the point home just a bit further: encryption does not equal immutable storage.


Another idea is to have a USB stick with two partitions: one unencrypted partition with something like Debian Live on it, and one LUKS-encrypted partition with a Tails ISO and VirtualBox DEBs inside.

  1. Boot into unencrypted Debian Live
  2. Unlock the LUKS partition
  3. Install and start VirtualBox
  4. Start the Tails ISO in VirtualBox

This both hides the existence of Tails on the USB stick and lets you verify the integrity of the Tails ISO and VirtualBox DEBs before using them.

You can also check the integrity of the Debian Live system by making a checksum file of its entire filesystem, such as by opening the Debian partition on a different computer and doing something like this:

sudo find /DebianPartition -type f -exec sha512sum "{}" \; >> SHA512SUMS

sudo sha512sum -c SHA512SUMS;

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .