I have got a bit lost and am not sure which technology to choose for full disk encryption. It is hard to tell if the information out there is still up to date. Is there a current best practice solution for this?

5 Answers 5


There are basicly 2 'standard' tools for partions:

  • TrueCrypt - cross-platform, open, plausible deniability
  • dm-crypt - Linux-specific, uses Linux Crypto API, can take advantages of any crypto hardware acceleration Linux supports, and device-mapper.

There's also cryptoloop, dm-crypt's predecessor

  • Removed "can't use hardware AES" for TrueCrypt. No longer true as of v7, released recently: truecrypt.org/docs/?s=version-history Aug 20, 2010 at 3:47
  • 4
    But as far as I know TrueCrypt can only encrypt windows drives if I want to boot my OS from it. So that would make dm-crypt the only solution.
    – Martin
    Aug 20, 2010 at 5:03

I've been using Debian with encrypted file system and swap on my notebook for three years without problems.

It asks for the password early during the Linux boot and then continues to boot right into my desktop (I disabled the login dialog).

The setup is roughly sda5 -> sda5_crypt -> physical volume dm-0 -> volume group Linux -> logical volumes /dev/Linux/root for / and /dev/Linux/swap for swap.

Swap is encrypted to avoid leaking information.

There is also an unencrypted 200MB boot partition for kernel, grub etc.

I remember that it was a complicated dance in the Debian installer until I got this right.

  • 1
    Modern Debian-Installers handle this without any complicated work. It all just works.
    – derobert
    Aug 20, 2010 at 18:25

I've used True Crypt before and find it to work very well.

  • 2
    It's true that TrueCrypt supports full-disk encryption with Linux, but it can only do that on the boot disk with Windows. I suspect the original poster is wanting to encrypt their boot disk, rather than a secondary disk that can be mounted after the system boots far enough that you can get a password to TrueCrypt. Aug 20, 2010 at 3:44

There are a number of options.

Distributions like OpenSUSE/SLES offer the option to encrypt one or more partitions at installation time.

Most of the time this is not an option as chances are, you do not want to reinstall your operating system.

I use the "encfs" file system, this should work on both Linux, MacOS and FreeBSD as encfs is built on top of FUSE (http://fuse.sourceforge.net/):


The idea is that you can designate certain directories as encrypted directories, and those would require you to enter a password at mount time to access them.


You might want to try ReiserFS or Reiser4. It is really secure and supports encryption; it's the only open-source filesystem the US army uses, and if something is good enough for the US army, it could be enough good for you .-)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .