Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Specifically, Linux.

I would love to be able to use TrueCrypt consistently across all my machines, be they Windows or Linux. As it stands, I can do full-disk encryption with pre-boot authentication only on Windows.

I don't really understand why this is. Are there technical challenges specific to Linux/Mac that make full disk encryption harder? Does anyone know whether TrueCrypt will support this in the near future.

PS. yes, I'm aware that there are other options. My goal is to simplify my life here and use the one tool across all machines.

share|improve this question
    
I haven't found references anywhere from the contrary about the status of ext2/3/4 partitions, if someone has stronger google-fu, please provide authoritative references. –  Braiam Mar 21 at 14:36
    
"I can do full-disk encryption with pre-boot authentication only on Windows." Untrue. Debian and Ubuntu have supported LUKS/dm-crypt based FDE for a long time now. It's not "Truecrypt"-compatible but it's effective FDE nonetheless. –  ultrasawblade Mar 21 at 15:10
    
@ultrasawblade again, OP wants a TrueCrypt solution. –  Braiam Mar 24 at 3:51
add comment

2 Answers

Because they just haven't done it yet. They would have to support ext1/2/3/4 and reiserfs, for example. Also, what's with SWAP? Swap has to be encrypted too, or part of your data is just there (at least what you've loaded, etc).

They also have to cope for GRUB and LILO. Where do they put it in? After the boot manager? Do they modify your init.rd?

It's of course more complicated because they'd have to cope with infinite kinds of configurations. Literally everyone could have their bootloaders somewhere else.

On Windows it's all in the same place and the same everytime.

share|improve this answer
    
So the other options for full-disk encryption on linux have overcome this complication, but truecrypt haven't done so yet? –  cantloginfromwork May 16 '11 at 11:35
    
Yep, the team of TrueCrypt hasn't quite completed this yet. I don't know of any beta or alpha of this, too. So they might not even be planning it :). –  sinni800 May 16 '11 at 11:36
    
those other options are built into linux, often at kernel level, so its simpler –  Journeyman Geek May 16 '11 at 12:05
2  
They don't have to figure ext2/3/4/whatever - proper FDE works at block level, and uses a block layer driver to decrypt. I suspect windows has this done through the boot storage driver and later registering truecrypt driver as filter between disk and filesystem drivers. –  p_l Feb 14 '13 at 21:57
    
"On Windows it's all in the same place and the same everytime." Ya, Windows gets loaded with a simple chainload +1, whereas Linux needs you to find kernel, initrd, etc... I can definitely understand some of the challenges of full-disk encryption.. Oh, well, at least the Linux community is full of Geeks who like to tinker with stuff. hopefully someone will DIY it. (I'm currently thinking of having a TC'ed /home folder..) –  JamesTheAwesomeDude May 11 '13 at 22:08
add comment

Because it's much work to implement that and there isn't much need for that for two reasons:

  • Linux and OS X have their own full disk encryption mechanisms, which can't be easily accessed from another OS¹, but
  • if one separates system from data partitions, the former don't usually contain interesting data one might want to access from another OS; so you can still use Truecrypt for the latter.

They also don't seems to have any plans to start any time soon.

On a side note, in my experience Truecrypt isn't nearly as well integrated into Linux and OS X system environments as into Windows, i. e. there's no mount helper for it.

¹ It is possible to access LUKS-encrypted ext2/3/4 partitions from Windows with FreeOTFE and ext2FSD under certain conditions, which is also my current setup.

share|improve this answer
    
So, there isn't a single clue if the team will work on this? –  Braiam Mar 24 at 18:36
    
I didn't even try to answer that because that wasn't the question (to my understanding). As far as truecrypt.org/future goes, there's no plan to implement that feature. –  David Foerster Mar 25 at 3:45
    
Is in my comment –  Braiam Mar 25 at 4:35
    
"if one separates system from data partitions, the former don't usually contain interesting data one might want to access from another OS" Well, not really true. If the kernel, other boot files and system binaries are unprotected, it's trivial to plant malicious code into the system partition. You could, for example, extract the kernel build configuration, make a new kernel of the same version and with the same configuration but which stores to some unencrypted location all keyboard I/O while cryptsetup is running, and have a trivial way of entry into the supposedly protected data. –  Michael Kjörling Apr 17 at 11:19
    
Entirely true, yet I never said anything about leaving system partitions unencrypted. I was merely talking about separate security schemes for system and non-system data. Besides, encryption isn't the only way to prevent injection of malicious code. My first idea would be electronic signatures. –  David Foerster Apr 18 at 11:49
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.