I want to have a full system encryption on my laptop. But I have two users, one for home and one for work and want a separate encryption for both. Sure I could do a full disk encryption with dm-crypt and use a second encryption layer with ecryptfs to encrypt the home directories. However this seems not to be a good idea for performance reasons. So how can I setup a system such that:
- the entire hard drive is encrypted
- when user 1 is logged in and user 2 not, the data of user 2 is encrypted for user 1 and vice versa
- I need to type in one password on boot which decrypts the system (like in a usual LVM/dm-crypt setup) and only a second one which logs in user x and decrypts his partition
- the performance is similar to a simple full disk-encryption
- the solution should work together with an ssd i.e. it should support TRIM
I want to use ubuntu as a distro for this, if this matters.