5

I'm considering encrypting the contents of my laptop, which runs Ubuntu 10.04 and has an ext4 + swap, and I'm wondering what the best options are here. I'm aware of:

  • TrueCrypt: either block-level encryption or virtual device within a file
  • ecryptfs: FS-level encryption
  • dm-crypt: block-level encryption
  • Loop-AES: block-level encryption
  • encrypted LVM: block-level encryption

I'm trying to get a taste for what the best options are (or what the trade-offs are) if I want to encrypt at least /var, /home, /tmp, /etc, and swap (think that pretty much covers most sensitive data, assuming I'm not installing secret applications into /usr or anything). Some guiding questions:

  • How big is the impact on both performance and battery life? What about performance on SSDs?
  • In my case, can I set it up without having to set up a new system - just take my existing ext4/swap and encrypt them? (Preferably without requiring some intermediate storage, but more importantly, preferably not requiring me to reinstall the OS?)
  • Are any of the above recommended over others? (At least going forward, on Ubuntu)? Any that are obsolete/deprecated?

I realize there are previous discussions on disk encryption in Linux but they tend to only cover subsets of the above options and questions. Thanks for any guidance.

2

2 Answers 2

1

encrypted LVM is my fave, don't encrypt swap in case you have hibernation or suspend to disk kick in. this can be a problem.

without intermediate storage - if there is a way, I don't trust it.

not that noticeable on the battery life for me, but my laptop runs on 53W unless i turn on the wireless and get about 6 hrs of battery life if i let the screen dim. video skips some when on battery, but other than that everything is fine.

SSDs, the cells are constantly charged/decharged to improve life on these filesystems. I don't think they have the throughput I would want for a running os, but whatever you like i guess.

i have seen sd or usb used to hold a REALLY long LUKS passphrase for LVM encryption.

the only shortfall of luks is that the decryption key is stored in ram, so if your computer gets taken while on there are recovery methods.

6
  • 1
    Encrypted swap is definitely supported. I've used hibernation with dm-crypt swap; you just have to type the password to come back from hibernation. Oct 3, 2010 at 21:58
  • 1
    Yes, encrypted swap is supported, I've been using it for over a year :-). Actually, on recent Debian/Ubuntu versions it's an option in the installer.
    – sleske
    Oct 3, 2010 at 22:44
  • "the only shortfall of luks is that the decryption key is stored in ram" This is the weak point of all FDE solutions, no way to avoid it. It's called a "cold boot attack".
    – sleske
    Oct 3, 2010 at 22:45
  • full disk encryption through hardware dongle doesn't have this shortfall Oct 3, 2010 at 23:41
  • Can LVM encryption encrypt swap? And is there a way to migrate to encrypted LVM without reinstalling the OS?
    – xyzzyrz
    Oct 4, 2010 at 8:38
2

I use encrypted LVM as well -- the Ubuntu server .iso supports this super-easily during installation, so I install from the server distro and run sudo apt-get install ubuntu-desktop (or sudo apt-get install xubuntu-desktop on older systems) once it's finished to install the desktop from there.

I don't really notice a performance hit, even on older 5400 RPM notebook drives. I haven't noticed this affecting battery life either -- if it did it wasn't more than a few percent.

Once you've chosen to encrypt the entire LVM volume, I'd advise NOT choosing to encrypt user folders on top of that, as experimenting with this caused the system to hang reliably on 9.04 and 9.10 (haven't tried on 10.04).

5
  • 1
    just a note, desktop and alternate support this during install also. i am using lucid and maverick though, so it may not be supported in older versions. Oct 3, 2010 at 15:40
  • That's good to know -- will save a little time next time I install a fresh dektop.
    – nedm
    Oct 3, 2010 at 16:53
  • Can encrypted LVM encrypt swap? And is there a way to migrate to encrypted LVM without reinstalling the OS?
    – xyzzyrz
    Oct 4, 2010 at 8:38
  • Yes, if you choose the encrypted LVM option your swap will be encrypted as well.
    – nedm
    Oct 4, 2010 at 16:28
  • I don't really notice a performance hit, even on older 5400 RPM notebook drives. If there is a performance impact you are more likely to notice it on a newer, faster drive. If your disk is slow, that's the main bottleneck. Jun 18, 2017 at 8:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .