Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm considering encrypting the contents of my laptop, which runs Ubuntu 10.04 and has an ext4 + swap, and I'm wondering what the best options are here. I'm aware of:

  • TrueCrypt: either block-level encryption or virtual device within a file
  • ecryptfs: FS-level encryption
  • dm-crypt: block-level encryption
  • Loop-AES: block-level encryption
  • encrypted LVM: block-level encryption

I'm trying to get a taste for what the best options are (or what the trade-offs are) if I want to encrypt at least /var, /home, /tmp, /etc, and swap (think that pretty much covers most sensitive data, assuming I'm not installing secret applications into /usr or anything). Some guiding questions:

  • How big is the impact on both performance and battery life? What about performance on SSDs?
  • In my case, can I set it up without having to set up a new system - just take my existing ext4/swap and encrypt them? (Preferably without requiring some intermediate storage, but more importantly, preferably not requiring me to reinstall the OS?)
  • Are any of the above recommended over others? (At least going forward, on Ubuntu)? Any that are obsolete/deprecated?

I realize there are previous discussions on disk encryption in Linux but they tend to only cover subsets of the above options and questions. Thanks for any guidance.

share|improve this question
One relevant previous question is What is the easiest way to encrypt a dir? (on Ubuntu). One possibility you've missed is encfs. – Gilles Oct 3 '10 at 21:56
On a separate note, mind that no encryption won't protect your data if someone gets temporary access to your laptop and installs malware on it — an “evil maid” attack. – Gilles Oct 3 '10 at 22:00
up vote 1 down vote accepted

encrypted LVM is my fave, don't encrypt swap in case you have hibernation or suspend to disk kick in. this can be a problem.

without intermediate storage - if there is a way, I don't trust it.

not that noticeable on the battery life for me, but my laptop runs on 53W unless i turn on the wireless and get about 6 hrs of battery life if i let the screen dim. video skips some when on battery, but other than that everything is fine.

SSDs, the cells are constantly charged/decharged to improve life on these filesystems. I don't think they have the throughput I would want for a running os, but whatever you like i guess.

i have seen sd or usb used to hold a REALLY long LUKS passphrase for LVM encryption.

the only shortfall of luks is that the decryption key is stored in ram, so if your computer gets taken while on there are recovery methods.

share|improve this answer
Encrypted swap is definitely supported. I've used hibernation with dm-crypt swap; you just have to type the password to come back from hibernation. – Gilles Oct 3 '10 at 21:58
Yes, encrypted swap is supported, I've been using it for over a year :-). Actually, on recent Debian/Ubuntu versions it's an option in the installer. – sleske Oct 3 '10 at 22:44
"the only shortfall of luks is that the decryption key is stored in ram" This is the weak point of all FDE solutions, no way to avoid it. It's called a "cold boot attack". – sleske Oct 3 '10 at 22:45
full disk encryption through hardware dongle doesn't have this shortfall – RobotHumans Oct 3 '10 at 23:41
Can LVM encryption encrypt swap? And is there a way to migrate to encrypted LVM without reinstalling the OS? – Yang Oct 4 '10 at 8:38

I use encrypted LVM as well -- the Ubuntu server .iso supports this super-easily during installation, so I install from the server distro and run sudo apt-get install ubuntu-desktop (or sudo apt-get install xubuntu-desktop on older systems) once it's finished to install the desktop from there.

I don't really notice a performance hit, even on older 5400 RPM notebook drives. I haven't noticed this affecting battery life either -- if it did it wasn't more than a few percent.

Once you've chosen to encrypt the entire LVM volume, I'd advise NOT choosing to encrypt user folders on top of that, as experimenting with this caused the system to hang reliably on 9.04 and 9.10 (haven't tried on 10.04).

share|improve this answer
just a note, desktop and alternate support this during install also. i am using lucid and maverick though, so it may not be supported in older versions. – RobotHumans Oct 3 '10 at 15:40
That's good to know -- will save a little time next time I install a fresh dektop. – nedm Oct 3 '10 at 16:53
Can encrypted LVM encrypt swap? And is there a way to migrate to encrypted LVM without reinstalling the OS? – Yang Oct 4 '10 at 8:38
Yes, if you choose the encrypted LVM option your swap will be encrypted as well. – nedm Oct 4 '10 at 16:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .