How can I create an encrypted USB storage device that can be accessed on any system if created on Linux using with cryptsetup, dm-crypt or similar programs that can create encrypted containers on USB devices?

I have looked at the likes of TrueCrypt, but development of that stopped back in 2014, and I don't particularly want to use something that's outdated and is bundled with some security flaws. Can't use Window's BitLocker since that's Windows only, same goes for FileVault on Mac.

I also would like to make it so that you don't need to rely on proprietary software to be installed on the system you plug it into to decrypt the storage device so you can plug in to any system and decrypt on the fly when a correct password/passphrase is supplied, like some universal portable multi-system software that can run on Windows, Mac, Linux. It would probably mean I'd have to create a small unencrypted partition on the USB device to put that portable software on to so it can be accessed and ran.


The Options:

Pretty much all options we have are OS dependent. luks/dm-crypt, BitLocker or FileVault.

If you trust Microsoft having a copy of your BitLocker keys on the cloud, Dislocker is an option. It is a software to help you mounting and dealing with this kind of encrypted device.

Also, there is some work being sone bi libfvde to make File Vault 2 available to other OSs but, as far as i know, this software is still in its childhood.

Finally, Librecrypt can help you to access luks volumes on Windows, but there is no solution when it comes to Mac OS being the client here.

Best you can do is to still rely on some multiplatform encryption software like TrueCrypt was before being discontinued.

The Story behind TrueCrypt:

As of TrueCrypt, much of the media coverage was cause the one of the head developers are now at Microsoft developing BitLocker(theory one), US government identified the developer and sent a National Security Letter demanding to put a backdoor into TrueCrypt(theory two)... Whatever is the reason, they don't have a real proof to point out why TrueCrypt became unsafe. Lots of speculations... Taking a look at Webcite:

And then the TrueCrypt developers were heard from . . .

Steven Barnhart (@stevebarnhart) wrote to an eMail address he had used before and received several replies from “David.” The following snippets were taken from a twitter conversation which then took place between Steven Barnhart (@stevebarnhart) and Matthew Green (@matthew_d_green):

  • TrueCrypt Developer “David”: “We were happy with the audit, it didn't spark anything. We worked hard on this for 10 years, nothing lasts forever.”

  • Steven Barnhart (Paraphrasing): Developer “personally” feels that fork is harmful: “The source is still available as a reference though.”

  • Steven Barnhart: “I asked and it was clear from the reply that "he" believes forking's harmful because only they are really familiar w/code.”

  • Steven Barnhart: “Also said no government contact except one time inquiring about a ‘support contract.’ ”

  • TrueCrypt Developer “David” said: “Bitlocker is ‘good enough’ and Windows was original ‘goal of the project.’ ”

  • Quoting TrueCrypt Developer David: “There is no longer interest.”

Even being an option, lets not take risks here, with security related software that suffers from speculation problems, and that are considered abandoned by the community.

The fork:

VeraCrypt is the fork based on TrueCrypt 7.1a with improvements, and shall work multiplatform with client installation. License is Apache v2 and shall meet the opensource aspect of software on the question.

As portability is the question here, this software is the best you can get because even using BitLocker, luks or FileVault, all of them are widely available to just one OS Family.

Best you can do here is to find a "portable" version of VeraCrypt(and trust that software), format 2 partitions on your usb drive with the first of them FAT32, put all portable versions(Mac, Windows, Linux) there, and make the second partition the encrypted one. That is the theory. I don't know if this will work :)

  • ...and binaries are available for windows and linux. Makes it very portable. – jc__ Jun 1 '17 at 19:12
  • 1
    Portable with the limitation that, you will have to still download a client... – user34720 Jun 1 '17 at 19:27
  • on Linux systems where veracrypt is not available in repos, an alternative is zulucrypt which can mount truecrypt/veracrypt volumes. – ccpizza Dec 2 '17 at 21:57

Aside from TrueCrypt there are few programs for Linux, Mac, and Windows.

I read that there are LUKS / cryptsetup compatible readers for all 3 OS types, and focusing on Linux it's what I'd use, but I don't know what the Mac or Win ones are. A web search for "LUKS windows" and "LUKS mac" might work.

I think OTFE on Win could read LUKS but it hasn't been updated for many years.

Taking a broader approach, instead of storing the programs and running them on potentially infected/spying foreign OS's (sounds like you'll be using random guest computers), you could store a live Linux OS on the USB and boot & run your own known safe OS, with the known working version of your encryption program.

Then there's only hardware keyloggers/monitors/security cameras to watch out for...

Or if that's overkill you could just use web storage (like a google drive) and any decent common web browser for any OS.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy