1

It says it is an optional step, but it is recommended to do this, it improves encryption to pre-fill the partition with random data.

What brings security filled with random data? Is it more difficult to decrypt the partition? I do not understand why it provides better security. That provide greater security aspects.

  • 1
    Just a wild guess: I think it prevents an attacker to know where are your data and where are the unoccupied areas. It's like encrypting all your mails and not only confidential ones. – lgeorget Apr 10 '14 at 7:56
4

That might be a question for security.stackexchange.com but I'm sure it has been asked before somewhere.

Basically, it masks "free space", so no one can tell how much data you have on your encrypted partition and where it is stored. How important that is to you is your affair.

If the disk was in use before that, it also gets rid of old, unencrypted data. Although zeroes would serve just as well in that regard, unless you have a smart media that compresses, deduplicates, trims instead of physically writing zeroes. So random data (like shred -n 1 or zeroing a random key crypt) is preferrable, as it can't be optimized away.

In general, though, it has very little effect on security, provided you have a good cipher. I use cryptsetup/LUKS on my SSD, but I happily allow TRIM which effectively zeroes out free areas so they're visible from the outside. I'm fine with that, the data itself is still encrypted anyway.

People worry way too much about this and way too little about unencrypted /boot that is easy to tamper with and keylog your passphrase... put /boot on USB with encrypted keyfiles and the USB in your pocket everywhere you go...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.