7

I have an unencrypted Windows10/Manjaro dual boot on a 256Gb SSD, plus a 1Tb HDD, where I store most of my data.

The partitions are organized as following:

1Tb HDD :    
 |_ sda1 : exFAT partition, readable by both W$ and Linux

256 Gb SSD : 
 |_ sdb1 : EFI system boot partition
 |_ sdb2 : Microsoft reserved partition
 |_ sdb3 : NTFS Windows system partition
 |_ sdb4 : NTFS Windows recovery partition
 |_ sdb5 : ext4 / partition for Linux
 |_ sdb6 : ext4 /home partition for Linux
 |_ sdb7 : linux swap

The bootloader is GRUB, and allows me to choose between the two systems.

What I am looking for is a way to encrypt both hard drives, and decrypting them by entering a password before GRUB. Of course I would like to keep the existing partitions, the fact that both systems can read the contents of the 1Tb HDD, and not break GRUB (if possible)

I have already checked Veracrypt for windows and LUKS for Linux, but Veracrypt seems to break GRUB and encrypts Windows only, and LUKS is Linux only.

3

You will need to use different windows/linux system encryptions and then use a common data partition with veracrypt and possibly fat or ntfs (as far as i know there is no ext driver for windows anymore due to enforced driver signatures. NTFS is not the best choice for linux, but may have advantages in windows).

If you want to encrypt windows with veracrypt, you need to get it to be installed in the partition not the hard drive bootloader section and chainload it from grub.

Another option which may be easier is to FDE one system and put the other one (with or without FDE) in a VM.

  • Thanks for the answer. Concerning NTFS, I have used exFAT rather which works for both OSes, even if it is not a perfect solution for me. The VM would work, but I am wondering how to move my existing windows installation to a VM without licence issues (I am working on a laptop). Also, what about performances (gaming, and photo editing) – mhham May 21 '17 at 23:18
1

The encryption software works inside the operating system. You can't load the disk encryption software before the operating system. There can be software with the same name that runs on both Linux and Windows (for example TrueCrypt/VeraCrypt), but it isn't the same code. So the encryption code can't be loaded before Grub. It can only be loaded after you've chosen an operating system and it's started booting.

It would be theoretically possible to have a bootloader stage that prompts for a password, and then passes this password via memory to each operating system. However such a mechanism doesn't exist, as far as I know; it couldn't work because the methods for passing a parameter would make the parameter available to users after boot, which is no good for a password.

Just type your password when the OS asks you, after the Grub prompt. You only have to enter it once per boot anyway.

How to encrypt disks works completely differently in Windows and Linux. It's easiest if you do it at installation time, however on Linux you can use luksipc (see Is there any utility or procedure available to dm-crypt my existing live data in place to make a full disk encryption). If you use luksipc, then setting up encryption on Linux, you'll need to run sudo update-grub and sudo update-initramfs, otherwise your system won't boot. Have a rescue disk handy because it's easy to make a mistake and end up with an unbootable system.

  • Thanks for the answer, and the link to luksipc. I will check this out. It does seems that I will have to play with the windows veracrypt bootloader and chainload it through GRUB, and also break and repair GRUB when moving the existing partition to LUKS. This is indeed not quite as straightforward as I was hoping. Also what about the second harddrive which needs to be accessible via both OSes, but still encrypted with the same passphrase ? – mhham May 21 '17 at 23:13
  • @mhham For that your only choice is TrueCrypt/VeraCrypt. I normally favor the operating system's native encryption, but if you need access from both Linux and Windows then TrueCrypt and derivatives is the only game in town. – Gilles May 21 '17 at 23:20
  • Isn't TrueCrypt deprecated ? Being able to decrypt the 1Tb HDD from both OSes is good news though ! I will look into that – mhham May 21 '17 at 23:23
  • @mhham Yes, TrueCrypt is deprecated because it is no longer maintained so nobody is fixing the bugs. VeraCrypt is a successor of TrueCrypt, essentially it's TrueCrypt with a new name and people maintaining it. – Gilles May 21 '17 at 23:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.