Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I'm looking for a solution to fully encrypt my dual-boot SSD drive (it's still new and empty, and I want to set up encryption before I put anything on it).

While there's a lot of chaos on the web regarding that question, it appears that TrueCrypt might be able to do this, although I might need its boot loader on an extra boot disk. From what I'm reading, some Linux tools (including some modified GRUB2) might also be able to do that.

However, I have my doubts, and no article I read really went in deep enough to answer a basic question: if the whole disk is encrypted, and some pre-boot tool asks the user for a key to decrypt it, doesn't that mean this tool has to run beneath the OS that's going to boot? In other words, are there tools that leave the OS unaware of the fact that the disks it sees are actually encrypted?

If there's no such tool, doesn't that mean the decryption tool somehow has to pass decryption information to the OS on boot? I can imagine that this would be hard to do cross-platform.

share|improve this question

2 Answers 2

up vote 5 down vote accepted

If the whole disk is encrypted, and some pre-boot tool asks the user for a key to decrypt it, doesn't that mean this tool has to run beneath the OS that's going to boot?

Yes, pretty much. Hardware-based full disk encryption does this: the encryption is handled entirely by the device (hard disk/flash) or possibly in a controller along the chain leading to the physical device(s), and is not "visible" to the OS.
With this, the OS does I/O exactly like it would if it was dealing with a plain, unencrypted device, the magic happens in hardware (and/or firmware - "below" the OS in any case).

If there's no such tool, doesn't that mean the decryption tool somehow has to pass decryption information to the OS on boot?

There would have to be some form of information transfer indeed, if the encryption cannot be done "underneath" the OS (either as above, or possibly using virtualization techniques – but then you sort of have two (or more) OSes running). And yes that means cross-OS is hard.
You'll also need the boostrap code (bootloader at the very least) to be un-encrypted if you don't have hardware/firmware assistance.

The Wikipedia disk encryption article has more about this.

share|improve this answer

If you have hardware (or more precisely firmware, i.e. BIOS) support for encrypted drives, then you can encrypt the full disk with the firmware. There are downsides to doing that: there aren't many computers around that support disk encryption, and it ties you to a particular firmware (or worse, if your computer has a TPM and the encryption key is in a TPM, it ties you to this particular motherboard unless you've backed up the storage encryption key).

If the operating system does the encryption, then there has to be a small space on the disk that is not encrypted, where the initial parts of the operating system are stored. A common configuration with Linux is to have a separate cleartext /boot partition, and to encrypt every other partition. “Full-disk encryption” is a bit of a misnomer: it's usually used to mean “full volume encryption”, where a volume is typically a partition rather than a disk. Full-disk encryption is when you don't encrypt every file (or at least a directory tree) separately.

Under Linux, the standard tool for full-disk encryption is dmcrypt. It is available in all major distributions and integrated in many installers.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.