7

I'm looking at having a dual boot system with Windows and Linux where both are encrypted.

I have one single hard drive where Windows and Linux shall both resides.

It could be with or without bitlocker, veracrypt, luks, UEFI, Secure Boot, TPM. As long as both OS are encrypted and I can dual boot when starting the computer.

I didn't try this link below, looks like it might work but it seems like a hack. I'm looking for more of an official/easy way to do this.

How to encrypt a dual boot system with Veracrypt?

EDIT: Well I did try the link and it's not working. I've spent a whole day on this trying pretty much everything and nothing works. I'd just like a dual boot system where both OS are encrypted, no matter how it is achieve.

4
  • What lead you to believe this is possible? Also windows has encrypted file type so does Linux why does the hard drive itself need to be encrypted? With UEFI you would need the UEFI driver for hard drive to do this. Jan 22, 2018 at 7:13
  • There are probably companies which make drives with drivers that encrypt the hard drive. Without dedicated hardware though read/write to hard drive would take performance hit. Jan 22, 2018 at 7:19
  • What makes you think I want the hard drive to be encrypted? I just said as long as both OS are encrypted, whatever the solution is.
    – Zurd
    Jan 22, 2018 at 23:17
  • Sorry I wasn't and still am not aware of any other way to "encrypt the os", that is different from what I said above. Jan 24, 2018 at 6:08

3 Answers 3

3

I'm quite sure it is possible to achieve a dual-boot system with Windows and Linux where both are encrypted on only one hard drive, unfortunately, I did not achieve it.

As a solution, I bought a second hard drive, installed Windows on it with BitLocker. Unplug it, plug the second hard drive, installed Linux with cryptsetup on the whole hard drive. Shutdown, plugged both, boot in Linux (configurable in your BIOS to know which one to boot), update grub, something like "sudo update-grub", it will automatically detect the other hard drive as Windows. Then when you reboot, you will have the GRUB interface, no password asked but after you select Windows or Linux, you will be asked for the password of the encryption. It's a perfect solution but you do need 2 hard drives.

1

Encryption is inside the O/S, so as I understand it, you would need to encrypt inside of Windows and inside of Linux (whatever flavor you choose) after the O/S loads. Even if you use the same product (like Veracrypt) you need to use the Windows version and the Linux version because it is different code for each. This would give you encryption on both systems without any hardware encryption, which is a generally accepted standard of security.

You will need to have the operating systems & preferably data in different locations -- partitions, drives or have one on a VM. And use a bootloader such as GRUB to choose a system at startup.

From my perspective, it is easier to encrypt at install time and I would separate the systems at least through a partition. Make sure you have bootable rescue media on hand, because it is pretty easy to make the system unbootable with all of these changes. Here's an answer on Stack Exchange with more details: https://unix.stackexchange.com/questions/366437/windows-linux-dual-boot-full-disk-encryption .

1
  • Having encryption inside the OS and having a boot partition unencrypted makes sense but whenI use VeraCrypt in Windows it also seems to encrypt the MBR. And then when I go on to install Linux, I cannot set encryption and I cannot touch the MBR, else it will mess up Windows. There's probably a way to do it with luks, I just can't figure it. Note that the VeraCrypt version of Linux doesn't allow to encryption the root partition, there's no menu "System / Encrypt System Partition/Drive...', Windows do though.
    – Zurd
    Jan 23, 2018 at 1:21
0

The "easy and official" way would include a machine with TPM. If your machine has an Intel vPro brand on it, you're guaranteed to have device-level encryption, OS-independent (either way both OS you mention are supported, not so sure about direct hardware access stuff like DOS of the olden days, but who cares for all practical intents and purposes?). The rest will require some work.

5
  • not sure what you mean by "guaranteed to have device-level encryption". If you mean that the whole disk is encrypted by hardware without the OS being aware of it, I'm pretty sure that's wrong. The TPM is just a place to store the encryption key so the user doesn't have to type it in every time.
    – Andy
    Apr 20, 2020 at 12:12
  • Per se, TPM is not what makes it happen. SED is. But AFAIK, only decent corporate grade BIOS would offer you the ability to utilize that. Built in TPM is usually a giveaway sign that you are onto a product that may do the job. Apr 24, 2020 at 7:11
  • OK I don't claim to be an expert but my impression is that a lot of decent laptops nowadays come with TPM but I'm not aware of any that have SED
    – Andy
    Apr 25, 2020 at 8:18
  • Things do move forward, Andy, perhaps my habits are dated. I'll look things up and run some tests tonight or tomorrow. Perhaps a more practical answer will emerge. Just about any corporate model should. DELL Latitude and Precision lines do. Corporate Lenovo Thinkpads and Thinkstations do. Apr 26, 2020 at 16:41
  • OK, this seems to be a relatively user-friendly document on the subject: pugetsystems.com/labs/articles/… , section What is Required for SED to work Apr 26, 2020 at 17:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.