8

My laptop is currently running Windows and Fedora, but I'm planning to install Arch Linux as my sole OS soon. This current setup is using whole disk encryption through TrueCrypt, but I'm unsure if it might be unnessesary for me.

I think I'll be using a somewhat simple partition sceme, something like: /, /boot, /home and swap.

I'm using my laptop for average everyday PC usage, programming, testing on local web server or on a virtual web server, audio/video playback, audio editing/recording etc.

I want to encrypt my next Arch only setup as well, but I can't decide whether to partition the whole disk, just the home partition or something else. I want to encrypt the system mainly for securing eventual lost/stolen data.

I'm thinking that dm-crypt with LUKS would be my best choice, but I'm not sure.

What should I choose and why?

2 Answers 2

11

In most scenarios, one of the following three schemes works well.

You only want to encrypt a few particularly confidential files.

Use encfs:

mkdir ~/.encrypted.d ~/encrypted
encfs ~/.encrypted.d ~/encrypted
editor ~/encrypted/confidential-file

Pros: no overhead to access non-confidential files; you can have different hierarchies with different passwords; you can easily copy a whole hierarchy of encrypted files to another machine; you don't need any special permissions to use encfs.

Cons: only encrypts files that are explicitly placed in the encrypted area; a little slower than disk-level encryption if you're going to encrypt a lot of files anyway.

You want your whole home directory to be encrypted.

Use ecryptfs.

Pros and cons. In a nutshell, ecryptfs works especially well when you want to encrypt your home directory using your login password; this is what Ubuntu uses if you tell the installer to encrypt your home directory. One con is that it's more difficult to ssh into your account, because if you're using key authentication for ssh, your public key must be placed outside the encrypted area and you'll need to type your password after ssh'ing in.

Whole disk encryption.

Use dm-crypt to encrypt everything except /boot.

Pros: everything is encrypted, so you don't have to worry about accidentally putting a file in the wrong place; block-level encryption provides better speed, especially if your processor has a hardware accelerator for AES (AES-NI on x86).

Cons: you need to provide the password at boot time, so you can't do an unattended boot; everything is encrypted, which can be slow if your processor is slow.

General notes

If you don't go for full disk encryption, remember that some temporary copies of your data may end up outside your home directory. The most obvious example is swap space, so if you're going to use encryption to prevent from a thief from reading your data, make sure to encrypt it (with dm-crypt). Since swap space is reinitialized at each boot, you can use a random key for it, and this way you can do an unattended boot (however, this makes hibernation impossible).

Put /tmp under tmpfs (it's a good idea anyway). See How to (safely) move /tmp to a different volume? for how to migrate /tmp to tmpfs.

Other at-risk areas are the mail drop (/var/mail) and the print spooler (/var/spool/cups).

3
  • How much do you think whole disk encryption slows down the Intel Core 2 Duo T5900, 2.2GHz ? It doesn't seem to be much at my current setup. Do you know if that processor has hardware accelerator for AES? I think I might go with whole disk encryption again since the on boot password con doesn't bother me much.
    – user20771
    Jul 11, 2012 at 19:23
  • @AndersHovgaard Core Duo is the generation just before AES-NI, I don't think any of them have it. This site doesn't list it as a feature and no Core Duo appears on Intel's list. It's difficult to tell whether you'll notice a slowdown in practice: it depends a lot of what else you use your CPU for, how much I/O you do, etc. Jul 11, 2012 at 23:42
  • I was getting excited about that encfs being a quick fix but it sounds like it is not secure. Here is the link - defuse.ca/audits/encfs.htm Security audit from 2014 by Taylor Hornby of Defuse Security. Debian warned me about it.
    – cardamom
    Feb 9, 2022 at 11:43
1

You should definitely go with luks as it is integrated with the Linux kernel and will work out of the box. Using other solution is not really worthwhile especially since some of them won't support AES-NI.

For a discussion about what to encrypt have a look at Any reason for encrypted /? but depending on your paranoia level and security needs just encrypting /home may be enough.

1
  • 3
    I would probably also recommend encrypting /tmp if you are using a traditional on disk setup (rather than tmpfs).
    – iambryan
    Jul 11, 2012 at 0:30

You must log in to answer this question.