I chose to erase disk when installing Ubuntu 20.04. Then I chose "Use LVM with the new Ubuntu installation" and "Encrypt the new Ubuntu installation for security".
What type of encryption is used, and how secure is it? Is it full disk encryption?
Super User is a question and answer site for computer enthusiasts and power users. It only takes a minute to sign up.Sign up to join this community
Despite the Ubuntu FullDiskEncryptionHowto leaves the impression it was a full disk encryption, it's out-of-date and replaced with Full_Disk_Encryption_Howto_2019. It's more accurately a full-partition encryption. The article describes the pre-installation steps required for almost Full Disk Encryption that encrypts...
the operating system partition and the boot-loader second-stage file-system which includes the Linux kernel and initial RAM disk.
It continues describing the limitations of the option from the Ubuntu installer:
However, this is much better than the Ubuntu installer Encrypt Disk option which only supports encrypting the operating system partition but leaves the boot-loader second stage file-system unencrypted and therefore vulnerable to tampering of the GRUB configuration, Linux kernel or more likely, the initial RAM file-system (
Furthermore, as told in the article, with UEFI Secure Boot it's possible to prevent tampering of the unencrypted boot stages by cryptographically signing them. However, Ubuntu installer isn't currently (as of July 2020) capable of doing any of this.
According to AlexP on Ask Ubuntu SE Specify encryption cipher to use during install?:
The default cipher is
aes-xts-plain64with 256-bit key and SHA-1 checksums. This is a good default. A very good default. Unless you are a qualified cryptographer you should leave it as is. Knowledgeable people have chosen this default after spending a lot of time and effort.
To find out what cipher is used for your encrypted container you can use the command
sudo cryptsetup statusand
sudo cryptsetup luksDump.
Even if the cipher has changed in three years, you should be able to check it with the commands.
Well, BitLocker defaults to XTS-AES 128. XTS-AES 256 is the same with stronger 256-bit AES.